A former IT infrastructure staffer admitted guilt for blocking Windows administrators from accessing 254 servers in an extortion attempt against his former employer, an industrial firm located in Somerset County, New Jersey.

According to official documents from the case, Daniel Rhyne, 57, of Kansas City, Missouri, illegally accessed the company network using an admin account between November 9 and November 25.

During this period, law enforcement asserts, he set up automated tasks on the company’s Windows domain controller to eliminate network admin accounts and modify the passwords for 13 domain admin accounts and 301 regular user accounts, setting them to “TheFr0zenCrew!”.

Prosecutors further allege that Rhyne also scheduled tasks to alter the passwords for two local admin accounts, which would affect 3,284 workstations, and for two supplementary local admin accounts controlling 254 servers on the company’s network. Further scheduled tasks included shutting down of servers and computers at random over several days in December of 2023.

Subsequently, on November 25, Rhyne sent his colleagues an extortion email entitled “Your Network Has Been Penetrated,” stating that all IT staff had lost access to their accounts and that server backups were wiped to prevent data recovery.

Moreover, the emails threatened the shutdown of 40 servers at random each day for ten days unless the company sent 20 bitcoin as ransom (approximately $750,000 at the time).

“Around November 25, 2023, at approximately 4:00 p.m. EST, network administrators at Victim-1 started receiving password reset notifications for both admin and other user accounts,” according to the legal complaint.

“Shortly after, Victim-1’s network admins noticed all of Victim-1’s domain admin accounts had been removed, preventing domain administrator access to Victim-1’s computer networks.”

Digital forensics experts found that on November 22, Rhyne was using a concealed virtual machine and his account to research methods for clearing Windows logs, modifying domain user passwords, and deleting domain accounts as he planned his extortion attempt.

A week prior, Rhyne had searched similar terms on his laptop, including “command line to remotely change local administrator password” and “command line to change local administrator password.”

Rhyne was taken into custody in Missouri on Tuesday, August 27, and later released following a court appearance. The charges of hacking and extortion to which he pleaded guilty can result in up to 15 years imprisonment.

Earlier in the month, a contractor who worked as a data analyst in North Carolina was convicted of extorting Brightly Software (a company offering SaaS, formerly SchoolDude) for $2.5 million.