ThreatPaper

#scheduled-tasks

2 cases

Insider sabotage at a New Jersey industrial firm: how the FBI traced Daniel Rhyne's domain-controller lockout

Core infrastructure engineer Daniel Rhyne got 32 months for planting scheduled tasks on his employer's domain controller that deleted 13 domain admins and reset passwords across 254 servers and 3,284 workstations, then demanding 20 bitcoin. A reused password and a rogue VM gave him away.

Insider ThreatExtortion & Blackmail
Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

State-SponsoredSocial EngineeringMalware