U.S. v. Daniel Rhyne (Industrial Insider Extortion)
Key Facts
- Legal Status: CHARGED in U.S. District Court for the Western District of Missouri.
- Primary Target Sector: Industrial Manufacturing, Critical Infrastructure.
- Documented Financial Loss: $750,000.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.
Root Cause & Infiltration Vector
Initial access established against Industrial Manufacturing, Critical Infrastructure infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.
Operational Impact & Financial Blast Radius
Resulted in $750,000 in documented financial liabilities. Demanded $750,000 ransom and caused significant corporate operational stoppage.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Rhyne accessed domain controllers using an unauthorized administrative service account that he covertly provisioned weeks earlier.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Industrial Manufacturing, Critical Infrastructure infrastructure.
Core infrastructure systems engineer who staged an extortion scheme against his own industrial employer, locking coworkers out of Active Directory domain controllers, changing administrator passwords, and demanding $750,000 in cryptocurrency.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
Rhyne arrested in Kansas City by FBI agents.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Daniel Rhyne | United States | charged | Pending | None | Former systems engineer charged with corporate extortion and intentional computer damage in W.D. Mo. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Rhyne accessed domain controllers using an unauthorized administrative service account that he covertly provisioned weeks earlier." | Criminal Complaint ¶ 9, Page 4 | reviewed |