A former core infrastructure engineer at a major industrial company in New Jersey has been handed a 32-month federal prison sentence for orchestrating a calculated cyberattack against his own employer’s computer network, locking out administrators, and demanding a substantial ransom paid in Bitcoin.
Daniel Rhyne, a 59-year-old resident of Kansas City, Missouri, learned his fate on September 28 during a hearing presided over by U.S. District Judge Michael A. Shipp in Trenton, New Jersey. The sentencing brings a formal legal conclusion to a high-profile corporate security breach that rattled the industrial firm and triggered a comprehensive federal investigation.
Rhyne had previously entered a guilty plea in April before the federal court. Under the terms of his plea, he admitted culpability to one count of extortion in relation to a threat to damage a protected computer, alongside a separate count of intentional damage to a protected computer. Federal prosecutors detailed how Rhyne used his privileged insider status and deep technical knowledge of the company’s internal architecture to execute the devastating digital assault.
According to the Federal Bureau of Investigation’s criminal complaint, Rhyne served as the industrial firm’s core infrastructure engineer and was recognized as the organization’s primary subject matter expert regarding the hosting and management of virtual machines. While federal prosecutors have chosen to keep the identity of the targeted business confidential, public court documents note that the enterprise is headquartered in Somerset County, New Jersey, and operates as a prominent national industrial company supplying critical products and services to sectors as diverse as biopharmaceuticals, oil, and gas.
The carefully timed cyberattack unfolded late in the afternoon on November 25, 2023. At approximately 4:00 p.m., the company’s network administrators noticed a sudden anomaly when they began receiving automated password reset notifications for hundreds of individual accounts simultaneously. As the administrative team scrambled to investigate the unusual activity, they discovered a far more alarming reality: all remaining domain administrator accounts had been entirely deleted from the system, effectively blinding the internal IT staff and cutting off their ability to manage or secure the network.
Just 44 minutes after the initial wave of password resets began, employees across the company received an ominous email bearing the subject line "Your Network Has Been Penetrated." The communication bluntly informed staff that the corporate IT administrators had been successfully locked out of the system and that all emergency digital backups had been purged. The extortionist warned that unless a ransom of 20 Bitcoin—valued at approximately $750,000 at the time—was paid by December 2, an additional 40 corporate servers would be permanently shut down each day for a period of ten days. Alternate language within the ransom demand noted an equivalent figure of approximately 700,000 euros, demanding payment exclusively in the cryptocurrency Bitcoin.
The Hidden Virtual Machine
As federal investigators and internal cybersecurity teams dove into the forensic data surrounding the breach, they quickly traced the origin of the attack to an unauthorized virtual machine that had been stealthily created within the company’s network weeks earlier, on November 9, 2023.
The rogue virtual machine utilized a distinct password: "TheFr0zenCrew!". Investigators soon realized that this exact phrase was not chosen at random; it was the identical password that had been subsequently forced onto the primary administrator account, distributed across 301 distinct user accounts during the attack, and assigned to the external email account used to transmit the ransom demand.
Forensic analysis of the network activity on the morning of the attack revealed that a remote desktop session originating from the hidden virtual machine had autonomously executed a series of scheduled tasks. These routines were engineered to systematically delete 13 crucial administrator accounts, alter security passwords impacting 254 corporate servers and 3,284 individual workstations, and program dozens of servers to shut down automatically beginning on December 3.
The FBI was ultimately able to tie the illicit virtual machine directly to Rhyne through a combination of digital artifacts and physical security logs. Investigators discovered a striking correlation in Rhyne’s corporate laptop activity: whenever browsing or operational activity took place on the hidden virtual machine, activity on Rhyne’s assigned laptop abruptly ceased, suggesting a single user operating two systems. Furthermore, physical access logs from the corporate headquarters placed Rhyne entering the building just minutes before his credentials logged into the network.
On the very day of the cyberattack, Rhyne’s corporate laptop connected to the enterprise network from an internet protocol address explicitly assigned to his residential home in Warren County, New Jersey, occurring just minutes before the remote session that established the destructive system tasks.
Digital breadcrumbs left behind by the perpetrator further solidified the government’s case. Days before the network lockdown, the user of the hidden virtual machine had conducted web searches for phrases such as "how to clear all windows logs from command line" and "how to remotely shutdown a computer using cmd," according to the criminal complaint filed by federal law enforcement.
While the original criminal complaint also included a charge of wire fraud against Rhyne—an allegation that did not ultimately appear in the two-count information to which he formally pleaded guilty—the severity of the offenses he admitted to carried substantial legal exposure. Under federal guidelines, Rhyne had faced a maximum potential sentence of five years in prison for the extortion count and up to ten years in prison for the intentional damage to a protected computer count. With the conclusion of the sentencing hearing, Rhyne must now serve the 32-month term ordered by Judge Shipp, bringing a definitive measure of accountability to the insider threat case.
Decentralized Finance (DeFi)
Decentralized Finance (DeFi)
Decentralized Finance (DeFi)
