IT employee charged over $750,000 cyber extortion plot in opposition to former employer
A former IT engineer is going through federal costs in the USA after his former employer discovered it had been locked out of its laptop programs and acquired a requirement for $750,000.
At roughly 4pm EST on November 25, 2023, workers at an industrial firm headquartered in Somerset County, New Jersey, started to obtain password reset notifications. Shortly afterwards, community directors found that area administrator accounts had been deleted, denying entry to the agency’s laptop programs.
44 minutes later, workers acquired an extortion e mail from an exterior deal with with the topic line “Your Community Has Been Penetrated”.
The e-mail warned the corporate that every one of its directors had both been locked out or deleted from the community, that the corporate’s backups had been deleted, and {that a} additional 40 servers could be shut down every day if a ransom of 20 Bitcoin (roughly US $750,000) was not paid.
57-year-old Daniel Rhyne, from Kansas Metropolis, Missouri, who labored as a core infrastructure engineer on the firm has been accused of unauthorised entry to the pc programs, exploiting an organization administrator account to run malicious instructions between November 8-25, 2023 that:
- modified administrator passwords to “TheFr0zenCrew!”
- deleted administrator accounts
- altered person account passwords to “TheFr0zenCrew!”
- scheduled the shutdown of quite a few servers and workstations.
Investigators declare that they managed to pinpoint the assault to a distant desktop session that had originated on an unauthorised digital machine (VM) operating on the corporate’s community. The identical VM was additionally discovered to have carried out a variety of incriminating internet searches within the run-up to the assault, together with:
- “Methods to set area person password from command line”
- “how one can delete a website <sic> account from the command line”
- “how one can remotely shutdown a pc utilizing cmd”
- “how one can clear all Home windows logs from command line”
- “internet person syntax change password”
In line with courtroom paperwork, the VM was accessed by a person account and laptop computer assigned to Rhyne. Rhyne’s laptop computer was stated to stop all web looking when web looking was occurring on the VM, suggesting that the identical individual was utilizing each the VM and Rhyne’s laptop computer.
Prosecutors additionally declare that the corporate’s CCTV and bodily entry logs report when Rhyne bodily entered their headquarters. These data instantly precede Rhyne’s person account logging into his laptop computer and, in lots of cases, then accessing the VM.
The fees in opposition to Rhyne embody extortion, intentional harm to protected computer systems, and wire fraud. If discovered responsible, he faces a possible most jail sentence of 20 years and fines of as much as $750,000.
