As reported by BleepingComputer, a former core infrastructure engineer was sentenced to 32 months in prison for locking over 3,000 devices on his employer's network in a ransomware-style extortion attempt. The case of Daniel Rhyne is not remarkable for its sophistication — it is remarkable for how utterly preventable every step of it was.
This is a textbook privileged identity failure. Rhyne retained domain administrator credentials after transitioning out of his role, used those credentials for 17 days of unauthorized access, deleted 13 domain admin accounts, reset passwords for 301 user accounts and two local admin accounts covering 254 servers and 3,284 workstations, and then demanded 20 BTC (approximately $750,000). He also deployed a hidden virtual machine to research his attack — a week before execution — and that VM went undetected throughout.
Why This Matters Beyond One Prosecution
The sentence closes one case but leaves a structural problem wide open. The attack chain Rhyne exploited — dormant admin credentials, no session monitoring on domain controllers, no alerting on mass password resets, no detection of rogue VMs — exists in thousands of networks today. The fact that a single identity could unilaterally delete every other domain admin and lock out an entire industrial company is not an anomaly. It is the default state of most Active Directory deployments that have not undergone rigorous tiering and privileged access management hardening.
Industrial organizations are especially exposed. Manufacturing and operational technology environments often maintain flat AD structures where engineering teams hold broad admin rights to keep production running. When those rights are not time-bound, not monitored, and not revoked on role change, the insider risk surface becomes existential.
What Failed Here
Shield53 Recommendations
Immediate Actions
- Audit all privileged accounts today. Enumerate every Domain Admin, Enterprise Admin, and local admin credential. Disable any account belonging to personnel who no longer require that access. Enforce a 30-day review cadence going forward.
- Implement tiered administration. Separate Tier 0 (domain controllers, AD), Tier 1 (servers), and Tier 2 (workstations) access. No single identity should have cross-tier admin rights. Use Microsoft's Tier 0/Tier 1/Tier 2 model or an equivalent PAM solution.
- Deploy just-in-time access. Replace standing admin credentials with time-bound, approval-based access using Azure PIM, CyberArk, Delinea, or equivalent. No one should hold permanent Domain Admin rights.
- Configure detection rules for mass AD changes. Alert on any event where more than N password resets or account deletions occur within a defined window. Microsoft Sentinel, Splunk, or native AD auditing can do this — it must be tuned and enabled.
- Isolate backup infrastructure. Backups must not be accessible from the same admin tier as production. Implement immutable backup storage and verify restore procedures quarterly.
- Deploy EDR with rogue VM detection. Ensure endpoints and servers are enrolled in EDR that flags unauthorized virtualization, new scheduled tasks on domain controllers, and lateral movement patterns.
Strategic Actions
Every organization should treat privileged identity as its own attack surface. The Rhyne case shows that a single motivated insider with standing admin rights can accomplish what most ransomware crews need initial access brokers and malware frameworks to achieve. Reducing the standing privilege footprint is the single highest-impact control available. If your Domain Admins group has more than three accounts, you likely have a problem. If any of those accounts belong to people who left or changed roles, you have an active incident waiting to happen.
The most dangerous threat actor in your environment may already have the keys — and you gave them to them willingly.
