[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwRJ9QpLN650KIxGyHvZWpwrLObgbxvDqd2ur0foQpVI":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"dd9fc533-937a-46a8-b3bd-49130800aa67","Engineer sentenced for locking over 3,000 devices on employer network","engineer-sentenced-for-locking-over-3-000-devices-on-employer-network-5a2d04","A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. [...]","A former core infrastructure engineer has been sentenced to 32 months in prison for conducting a ransomware-style attack against his former employer. The engineer, Daniel Rhyne, used an administrator account to lock over 3,000 devices, delete domain accounts, and demand a 20 bitcoin ransom.","Former engineer sentenced to 32 months for ransomware-style attack on employer.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fengineer-sentenced-for-locking-thousands-of-devices-on-employer-network\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F11\u002F10\u002FHacker_IAB.jpg","2026-10-06T08:19:24+00:00","2026-10-06T10:00:24.107636+00:00",7,[17,20],{"name":18,"type":19},"Daniel Rhyne","threat_actor",{"name":21,"type":22},"Windows","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[47,51],{"type":48,"value":49,"context":50},"malware","TheFr0zenCrew!","Password used for administrator and user accounts, and subject of ransom email.",{"type":48,"value":52,"context":53},"PsPasswd","Password used for local administrator accounts.",[21],{"controls":56,"vendors":143},[57,85,114],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":58,"product_name":74,"url":75,"description":76},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":86,"name":87,"problem":88,"products":89},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":115,"name":116,"problem":117,"products":118},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":159},"insider-threat-rogue-engineer-locks-3000-devices-in-ransomware-style-attack","Insider Threat: Rogue Engineer Locks 3,000 Devices in Ransomware-Style Attack","Daniel Rhyne exploited privileged administrator credentials to lock thousands of devices, delete domain accounts, and extort his former employer — a textbook insider threat scenario. The root cause was insufficient controls around privileged access, particularly the lack of timely deprovisioning and activity monitoring for high-privilege accounts. This case highlights the catastrophic damage a single trusted insider can inflict when access controls are not enforced with the principle of least privilege and robust oversight. Organizations often focus security efforts on external threats while underestimating the risk posed by disgruntled or departing employees with elevated access. Prompt access revocation and continuous monitoring of privileged account activity are non-negotiable safeguards.",[149,150,151,152,153,154,155,156,157,158],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 5 – Account Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 PS-4 – Personnel Termination","NIST SP 800-53 IR-6 – Incident Reporting","ITIL Service Transition – Access Management","GDPR Article 32 – Security of Processing (where EU data is involved)",{}]