Engineer who locked his firm out through its domain controller gets 32 months in prison

Each step SecurityWeek describes is routine administration, run as scheduled tasks on the firm's domain controller ^[4]. The jobs deleted 13 domain administrator accounts and reset passwords on the others, 318 accounts in all, generally to 'TheFr0zenCrew!' ^[4][14][6]. Four of the resets hit local administrator accounts. Two covered 254 servers and two covered 3,284 workstations ^[5]. Four passwords cut the firm off from 3,538 machines ^[15].

SecurityWeek places the tasks on the controller in November 2023 and has them finishing late in the afternoon of November 25 ^[4][7]. Depending on when they were placed, the jobs sat on the controller for as long as 24 days before they fired ^[16]. The extortion email also claimed every backup had been deleted and threatened to shut down 40 random servers a day for ten days ^[8]. Those claims came from the attacker, quoted from his email ^[8].

The source does not say whether Rhyne still worked at the firm in November 2023, or whose credentials created the tasks ^[3]. Either way, we think two controls apply. A new scheduled task on a domain controller should alert someone other than the person who created it. A job that deletes domain administrators or resets hundreds of passwords should need a second approver. Here, either control would have had up to 24 days to act ^[16].

Attribution took months ^[17]. FBI Special Agent Timothy Lee filed the criminal complaint on August 8, 2024, 257 days after the lockout ^[12][17]. Rhyne had moved to Kansas City by then and was arrested there on August 27 ^[12]. He was sentenced on September 28, 2026, 34 months after the jobs fired ^[1][18].

The password suggests a crew. Beyond it, the public record describes one insider and one employer: a Somerset County, New Jersey firm serving industries that include oil and gas, chemistry and healthcare ^[6][3][13]. We see nothing in that record tying the attack to a ransomware operation or to other victims.