Man admits to locking thousands of Windows devices in extortion plot

A former core infrastructure engineer, Daniel Rhyne, pleaded guilty after using an administrator account to remotely change passwords for hundreds of domain and local accounts, delete domain admin accounts, schedule shutdowns of servers and workstations, and send a ransom demand of 20 BTC to his employer; the activity (Nov–Dec 2023) impacted 254 servers and thousands of workstations, forensic analysis found searches about clearing Windows logs and changing admin passwords, and prosecutors filed hacking and extortion charges.