A Kansas City, Missouri man has been sentenced to 32 months in jail for crimes related to a ransom attack against his own company.
The DOJ has announced the sentencing of Daniel Rhyne. He had already pleaded guilty to ‘extortion in relation to a threat to cause damage to a protected computer’ and ‘intentional damage to a protected computer’.
Fifty-nine-year-old Rhyne had been a core infrastructure engineer at an industrial firm headquartered in Somerset County, New Jersey. The firm provides services to industries involved in aquaculture, biopharmaceuticals, chemistry, electronics, food and beverage, healthcare, hydrogen mobility, manufacturing and industrial processing, metals, oil and gas, and pulp and paper.
In November 2023, Rhyne placed scheduled tasks on the firm’s domain controller that would delete 13 domain administrator accounts; change passwords to 301 domain user accounts; change passwords to two local administrator accounts that would impact 254 servers; and change passwords to two local administrator accounts impacting 3,284 workstations. The effect was to deny the firm access to its systems and data.
Where passwords were changed, it was generally to ‘TheFr0zenCrew!’.
The scheduled tasks were completed late afternoon on November 25. Within an hour, certain employees received an e-mail from an external address. The subject line said, “Your Network Has Been Penetrated”. It warned that administrators had been locked out or deleted, all backups had been deleted, and that, unless a ransom was paid, 40 random servers would be shut down each day over a ten-day period.
Rhyne was demanding a payment of 20 bitcoin, worth at the time approximately $750,000.