Infrastructure Engineer Pleads Guilty to Locking 254 Windows Servers at Former Employer

A former infrastructure engineer pleaded guilty to a November 2023 insider cyber-extortion attack in which he used a hidden virtual machine and built-in administrative tools (scheduled tasks, net user, Sysinternals PsPasswd) to delete 13 domain admin accounts, change 301 domain user passwords to “TheFr0zenCrew!”, and lock out 254 Windows servers and 3,284 workstations while demanding 20 BTC; investigators linked activity to the suspect via laptop searches, remote access logs, and the ransom email account.