A federal court in Trenton, New Jersey has handed down a 32-month prison sentence to a former core infrastructure engineer who tried to extort his ex-employer for roughly $750,000 in bitcoin after rigging its Windows network to self-destruct. The case, which ended with sentencing on September 28, 2026, offers an unusually detailed look at how a trusted insider’s deep access can be turned into a precision sabotage campaign — and how digital forensics eventually unwound it.

From Trusted Specialist to Saboteur

Daniel Rhyne, 59, of Kansas City, Missouri, worked as the specialist responsible for hosting virtual machines at an unnamed industrial company headquartered in New Jersey. That role gave him exactly the kind of privileged access that security teams worry about most: the ability to spin up infrastructure that looks legitimate to everyone except the person who created it.

According to the criminal complaint, investigators traced the malicious activity back to an unauthorized virtual machine quietly created inside the company’s network on November 9, 2023. Over the following two weeks, that hidden machine was used to repeatedly log into a legitimate domain administrator account via remote desktop sessions — effectively using the company’s own trusted credentials as a staging point for the attack that followed.

Sixteen Scheduled Tasks, One Afternoon

The sabotage itself was methodical rather than smash-and-grab. On November 25, 2023, starting at roughly 8:12 a.m., the compromised administrator account created around 16 unauthorized scheduled tasks on the network. Six of those tasks were timed to fire that same afternoon, deleting 13 domain administrator accounts outright and resetting passwords on 301 domain user accounts. The remaining tasks were set to begin shutting down dozens of servers starting December 3 — a slow-burn second wave designed to keep inflicting damage even after the initial disruption.

Notably, the attack relied entirely on native Windows administration tools rather than any custom malware or ransomware payload. The “net user” command handled the domain account manipulation, while Microsoft’s own Sysinternals utility, PsPasswd, was used to change local administrator passwords across 254 servers and 3,284 workstations. Using built-in, trusted tooling in this way is a known technique for evading security products tuned to flag unfamiliar executables.

The Ransom Email

At 4:00 p.m. that day, IT staff began receiving a flood of password-reset notifications, quickly followed by the discovery that several domain administrator accounts had simply vanished, locking them out of their own network. Forty-four minutes later, an external email landed in employee inboxes with the subject line “Your Network Has Been Penetrated.” It demanded 20 bitcoin — about $750,000 at the time — with a payment deadline of December 2, and threatened to shut down 40 random servers per day for ten days if the company refused. The email also claimed that backups had been deleted, though the complaint notes this was an unverified assertion inside the ransom message rather than a separately confirmed forensic finding.

How Investigators Closed the Loop

Unwinding who was behind the attack came down to old-fashioned correlation rather than any single smoking gun. Investigators linked the hidden virtual machine to Rhyne’s company laptop and user account, then cross-referenced physical badge-swipe records and security camera footage that placed him at the company’s offices shortly before matching laptop logins and VM access. Separately, remote connections tied to the attack were traced to an IP address registered to his home.

The detail that appears to have sealed the case was password reuse: the hidden virtual machine, the altered domain accounts, and the account used to send the extortion email all shared the same distinctive password string, “TheFr0zenCrew!” Investigators also recovered browser search history connected to Rhyne covering topics like changing passwords, deleting accounts, remotely shutting down servers, and clearing Windows event logs — a digital trail of premeditation that is difficult to explain away.

Why This Case Matters for Defenders

Rhyne pleaded guilty to extortion involving threats to damage a protected computer and to intentional damage to a protected computer, and U.S. District Judge Michael A. Shipp imposed the sentence. For security teams, the case is a pointed reminder that insider threat programs need to cover more than malware detection. Organizations should consider:

• Enforcing strict separation of duties so no single administrator can create virtual machines, modify domain-wide account policies, and reset credentials unchecked.
• Monitoring for anomalous scheduled-task creation, especially bulk creation events tied to a single session.
• Auditing offboarding and access-review processes for employees who hold deep infrastructure privileges, even when there is no apparent reason for concern.
• Treating password reuse across administrative accounts as a detectable, correlatable signal rather than just a hygiene issue.

The sentence closes a case that began as a quiet act of sabotage and ended as a thoroughly documented cautionary tale about what a disgruntled insider with the right access can attempt — and how that same access ultimately became the evidence trail that caught him.