Fr0zen Out: Ex-Engineer Gets 32 Months for Self-Inflicted Bitcoin Ransom Plot Against His Own Employer 🥶

A former core infrastructure engineer has been sentenced to 32 months in federal prison for attacking his New Jersey employer's computer network and demanding 20 BTC, then valued at roughly $750,000, in ransom. Daniel Rhyne, 59, of Kansas City, Missouri, was sentenced on September 28 by U.S. District Judge Michael A. Shipp in Trenton, the U.S. Attorney's Office for the District of New Jersey said Monday. Rhyne pleaded guilty in April to extortion involving a threat to damage a protected computer and to intentional damage to a protected computer.

According to the FBI's criminal complaint, Rhyne served as the unnamed industrial company's subject matter expert on hosting virtual machines. The company is headquartered in Somerset County, New Jersey, and serves industries including biopharmaceuticals and oil and gas. On November 25, 2023, at about 4 p.m., the company's network administrators began receiving password reset notifications for hundreds of accounts and discovered that all other domain administrator accounts had been deleted. Forty-four minutes later, employees received an email titled "Your Network Has Been Penetrated," claiming administrators had been locked out and backups deleted. The message threatened to shut down 40 additional servers each day for 10 days unless 20 BTC, equivalent to approximately €700,000, was paid by December 2.

Investigators traced the intrusion to an unauthorized virtual machine created on the company's network on November 9, 2023, protected by the password "TheFr0zenCrew!" — the same password later applied to the compromised administrator account, to 301 user accounts, and to the email account that delivered the ransom demand. On the morning of the attack, a remote desktop session from that machine created scheduled tasks to delete 13 administrator accounts, change passwords affecting 254 servers and 3,284 workstations, and shut down dozens of servers beginning December 3, the complaint states.

The FBI linked the virtual machine to Rhyne through his company laptop. Browser activity on the laptop ceased whenever activity occurred on the hidden machine, and building access logs showed Rhyne entering the company's headquarters minutes before his account logged in. On the day of the attack, his laptop connected to the network from an IP address assigned to a Warren County, New Jersey, property minutes before the session that configured the malicious tasks. Days earlier, the hidden machine's user had searched for "how to clear all windows logs from command line" and "how to remotely shutdown a computer using cmd." The complaint also charged Rhyne with wire fraud, a count that did not appear in the two-count information to which he ultimately pleaded guilty; he had faced a maximum of five years on the extortion count and 10 years on the damage count.