[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1HUKeep-4omqgMbeUee-w4vm9XnbHbNYS-Dkhem1D80":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b74306d1-f82e-4967-bcd7-baf1ee2bf4c8","Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison","insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison-98b409","The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers. The post Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison appeared first on SecurityWeek.","Daniel Rhyne, a former core infrastructure engineer at an industrial firm, has been sentenced to 32 months in prison for intentionally damaging a protected computer and extortion. Rhyne used his access to delete admin accounts, reset hundreds of user passwords, and demanded 20 bitcoin (approx. $750,000) to prevent further system shutdowns. The FBI traced the attack back to Rhyne's IP address, leading to his arrest and conviction.","An industrial firm's former engineer was sentenced to prison for a cyber extortion plot against his employer.","https:\u002F\u002Fwww.securityweek.com\u002Finsider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002Fhacker-sentenced-prison.jpeg","2026-10-10T11:00:00+00:00","2026-10-10T12:00:18.758052+00:00",8,[17,20],{"name":18,"type":19},"Daniel Rhyne","threat_actor",{"name":21,"type":22},"bitcoin","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"malware","TheFr0zenCrew!","Password used to lock out user accounts during the attack.",[21],{"controls":53,"vendors":140},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,66,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":55,"product_name":63,"url":64,"description":65},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":83,"name":84,"problem":85,"products":86},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":112,"name":113,"problem":114,"products":115},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"insider-threat-engineer-abuses-privileged-access-for-extortion","Insider Threat: Engineer Abuses Privileged Access for Extortion","Daniel Rhyne exploited his privileged access as a core infrastructure engineer to delete admin accounts and reset hundreds of passwords, holding his employer hostage for $750,000 in bitcoin. The root cause was insufficient controls around privileged account usage, including a lack of real-time alerting on mass account modifications and inadequate offboarding or access review processes. This case highlights how insider threats can be just as devastating as external attacks — and often harder to detect when trusted employees misuse legitimate credentials. The fact that the FBI was able to trace the attack to Rhyne's IP address underscores the critical value of robust logging, but the damage had already been done by the time forensics were applied.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST AU-12: Audit Record Generation","NIST IR-6: Incident Reporting","NIST SP 800-53 PS-4: Personnel Termination","ISO 27001 A.9.2: User Access Management","ISO 27001 A.12.4: Logging and Monitoring","ITIL: Access Management Process",{"NIST AC-6: Least Privilege":158,"NIST AC-2: Account Management":159,"NIST IR-6: Incident Reporting":160,"ITIL: Access Management Process":161,"CIS Control 5: Account Management":162,"CIS Control 8: Audit Log Management":163,"NIST AU-12: Audit Record Generation":164,"ISO 27001 A.9.2: User Access Management":165,"CIS Control 6: Access Control Management":166,"ISO 27001 A.12.4: Logging and Monitoring":167,"NIST SP 800-53 PS-4: Personnel Termination":168},"Least privilege limits each engineer's power to delete admin accounts and reset passwords.","Account management covers monitoring privileged accounts for unusual changes.","Prompt incident reporting helps the organisation respond to insider sabotage quickly.","Access management processes control who gets privileged access and how it is reviewed.","Account management, including review of admin accounts, limits what one engineer can change.","Audit logs and alerts would have flagged mass password resets and admin account deletions.","Generating audit records of privileged actions supports real-time alerting on mass changes.","User access management controls privileged access allocation and review.","Access control management, such as requiring approval for privileged changes, limits insider abuse.","Logging and monitoring would catch mass account changes as they happen.","Personnel controls cover revoking access promptly when staff leave or are under suspicion."]