Infrastructure engineer gets 32 months for locking his employer out of 3,538 machines

Rhyne's unauthorized access ran from November 8 to November 25, according to court documents ^[3]. The criminal complaint puts discovery at the end of that span. "On or about November 25, 2023, at approximately 4:00 p.m. EST, network administrators employed at Victim-1 began receiving password reset notifications for a Victim-1 domain administrator account, as well as hundreds of Victim-1 user accounts," the complaint reads ^[8]. It continues: "Shortly thereafter, the Victim-1 network administrators discovered that all other Victim-1 domain administrator accounts were deleted, thereby denying domain administrator access to Victim-1's computer networks" ^[9].

The endpoint lockout went through local accounts. Tasks reset two local admin accounts to "PsPasswd," cutting off 254 servers, and reset two more admin accounts, cutting off 3,284 workstations ^[4]. In total, tasks on one domain controller locked 3,538 machines ^[12].

He searched before he acted. A week before November 22, on his laptop, Rhyne looked up "command line to change local administrator password," "command line to remotely change local administrator password," and "how to remotely shutdown a computer usign cmd" ^[7]. He later ran local admin resets and remote shutdowns ^[4][10].

Rhyne was on the inside when this happened. BleepingComputer describes the New Jersey company as the one that employed him ^[2], and his ransom email went to coworkers ^[6]. Offboarding would not have closed this route. The reported court documents do not say whether the administrator account he used was his own; they describe the access as unauthorized ^[3]. I think the control this case points to is an alert on new scheduled tasks on a domain controller, raised while the tasks are still waiting to run. The notifications in the complaint arrived when the tasks executed ^[8].

The ransom email said server backups had been deleted ^[6]. The claim is Rhyne's own, made in a demand for money. His threat of 40 server shutdowns a day for ten days came to 400 shutdowns ^[13]. He did shut down random servers and workstations over several days in December 2023, according to BleepingComputer's account of the court documents ^[10].

BleepingComputer pairs the case with Cameron Curry, a 27-year-old North Carolina data analyst contractor sentenced in March to two years in prison for extorting his employer, Brightly Software, for $2.5 million ^[11]. Each man was an insider who tried to extort his own employer ^[1][11]. The two cases involve different employers and different roles. Rhyne's sentence is eight months longer than Curry's ^[15].