Insider Threat

Core infrastructure engineer Daniel Rhyne got 32 months for planting scheduled tasks on his employer's domain controller that deleted 13 domain admins and reset passwords across 254 servers and 3,284 workstations, then demanding 20 bitcoin. A reused password and a rogue VM gave him away.

Three men who worked in incident response ran BlackCat attacks. One of them was simultaneously negotiating on behalf of ransomware victims — and passing the attackers his own clients' insurance limits.