Infrastructure Engineer Sentenced to 32 Months for Active Directory Extortion Plot

When an enterprise administrator turns against their own organization, traditional network perimeter defenses offer virtually no protection. Daniel Rhyne, a 59-year-old former core infrastructure engineer for an industrial firm headquartered in Somerset County, New Jersey, has been sentenced to 32 months in federal prison following a destructive insider extortion attack. By abusing administrative rights on his company’s internal network, Rhyne attempted to extort his employer for $750,000 in cryptocurrency after executing scheduled tasks that deleted core administrator accounts and altered local credentials across thousands of endpoints.

Technical Details of the Domain Controller Sabotage

In November 2023, while still employed as a core infrastructure engineer, Rhyne utilized elevated privileges to access the company’s Active Directory domain controllers. Domain controllers serve as the centralized trust authority within an enterprise Windows domain, meaning any account or automated task executed on them operates with sweeping authority over connected domain resources and member endpoints.

On November 25, 2023, scheduled tasks previously staged by Rhyne executed across the environment. The automated routines were designed to strip operational control from the IT and security teams by performing four distinct destructive actions:

• Deleting 13 domain administrator accounts to eliminate central domain management capabilities.
• Resetting the passwords for 301 standard domain user accounts to disrupt day-to-day operations.
• Altering the credentials for two local administrator accounts across 254 enterprise servers.
• Altering the credentials for two local administrator accounts across 3,284 corporate workstations.

To further lock out administrators, Rhyne standardized the modified local credentials across the server and workstation fleet to a single string: TheFr0zenCrew!. Because local administrator accounts are frequently used by incident response teams to regain control of endpoints when domain-level authentication is impaired, changing these passwords simultaneously across 3,538 systems left the victim organization without standard administrative fallback options.

The impacted industrial firm provides specialized infrastructure and operational services across multiple critical infrastructure sectors, including biopharmaceuticals, healthcare, hydrogen mobility, oil and gas, food and beverage, electronics, chemistry, metals, pulp and paper, and aquaculture.

The Extortion Demand and Forensic Investigation

Within an hour of the scheduled tasks executing on late afternoon of November 25, several company employees received an extortion email sent from an external account with the subject line “Your Network Has Been Penetrated”. The email claimed that domain administrators had been removed, backups were destroyed, and that 40 random servers would be forcefully shut down every day over a 10-day period unless a ransom was paid.

Rhyne demanded 20 bitcoin, valued at approximately $750,000 at the time of the incident. Rather than negotiating or paying the extortion demand, the company launched an immediate internal forensic investigation into network anomalies and authentication activity.

Because Rhyne attempted to mask his identity behind external email addresses and simulated external attacker tactics, investigators cross-referenced internal system logs and remote access records against physical access logs from the firm’s facilities. The internal log correlation allowed security teams and the FBI to trace the unauthorized access directly to Rhyne’s residential IP address in Warren County, New Jersey.

Following the joint investigation by the victim firm and federal agents, FBI Special Agent Timothy Lee filed a formal criminal complaint on August 8, 2024. Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, where he had relocated following the incident. On April 1, 2026, Rhyne pleaded guilty in federal court in Trenton, New Jersey, before U.S. District Judge Michael A. Shipp to charges of intentional damage to a protected computer and extortion in connection with a threat to cause damage to a protected computer. Judge Shipp formally sentenced Rhyne on September 28, 2026, to 32 months in federal prison.

Mitigating Privileged Insider Threats in Enterprise Active Directory

This incident highlights the severe blast radius associated with unchecked administrator access on Active Directory domain controllers. External threat actors typically spend days or weeks attempting privilege escalation and lateral movement; a rogue domain engineer already possesses the access required to execute domain-wide changes instantly.

To mitigate risks associated with high-privilege insider abuse, organizations managing critical infrastructure must enforce strict governance around domain controller access:

• Privileged Access Management (PAM) and Just-in-Time Access: Domain Administrator accounts should not remain active for general day-to-day engineering tasks. Organizations should enforce Just-in-Time (JIT) elevation requiring peer approval or dual-authorization workflows before domain-level administrative rights are granted.
• Local Administrator Password Randomization: Reusing static local administrator credentials across thousands of endpoints creates a single point of failure. Deploying solutions such as Microsoft Local Administrator Password Solution (LAPS) ensures that every endpoint maintains a unique, automatically rotated local admin password stored securely in Active Directory.
• Immutable Audit Logging and Behavioral Alerts: Domain Controller alterations—specifically the creation of scheduled tasks, bulk password changes, and account deletions—should immediately trigger out-of-band alerts to a Security Operations Center (SOC). Event logs should be streamed continuously to append-only, off-site log management systems that cannot be modified by local domain administrators.
• Separation of Duty for Domain Objects: Creating scheduled tasks on domain controllers or modifying Default Domain Policies should require multi-party approval to prevent single individuals from staging destructive batch operations.