Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 前核心基础设施工程师因勒索软件攻击雇主获刑32个月
美国联邦法院判处丹尼尔·赖恩（Daniel Rhyne）——一名前核心基础设施工程师——入狱32个月。赖恩此前认罪，承认其策划了一起针对新泽西州前雇主的勒索软件攻击。
赖恩瞄准了该公司的计算机网络，要求支付比特币以换取停止进一步的破坏行为。
攻击细节
现年59岁的密苏里州堪萨斯城居民赖恩被认定对未经授权访问前雇主的IT基础设施负有责任。受害公司位于新泽西州萨默塞特县，业务涵盖生物制药、石油和天然气等主要行业，但当局尚未公开其身份。
2023年11月25日下午4点左右，该公司网络管理员开始收到警报，显示数百个用户密码正在被重置。调查人员随后确定，在同一事件中，所有其他域管理员账户均被删除。
在第一次警报发出不到一小时后，公司员工收到了一封标题为“您的网络已被渗透”的电子邮件。邮件指出，IT管理员已被锁定，且所有备份文件均已移除。赖恩威胁称，除非公司支付20枚比特币（当时价值约75万美元），否则将连续10天每天关闭40台公司服务器。该要求也以欧元形式提出，总额为70万欧元，付款截止日期定为12月2日。
The network administrator received an email saying "Your network has been penetrated." Attackers warned that if 20 bitcoins were not paid before December 2, backup files were deleted and administrator accounts were locked, the company would shut down 40 servers a day for 10 days.
FBI Investigation and Evidence
FBI agents traced the source of the breach to an unauthorized virtual machine that was initialized within the company network on November 9, 2023. The password for this virtual machine is set to "TheFr0 zenCrew!", This detail was later discovered in 301 user accounts, key administrator accounts, and emails used for extortion requests.
Technical analysis showed that on the morning of the attack, remote desktop sessions from the malicious virtual machine created tasks, including deleting 13 administrator accounts, changing passwords affecting 254 servers and 3,284 workstations, and plans to shut down dozens of servers starting on December 3.
Further digital forensics directly linked Ryan's company's issuance of notebooks to the attack. The forensics team found that whenever an operation occurred on the hidden machine, all browsing activity on Ryan's laptop stopped. Physical access records confirm that he was present at the company's headquarters shortly before his credentials were used in the breach.
On the day of the incident, Ryan's laptop accessed the company's systems from his home in Warren County, New Jersey, and operated directly before launching the attack. In the days leading up to the breach, the browsing history of compromised machines included searches for items such as "how to clear all Windows logs from the command line" and "how to use cmd to shut down a computer remotely."
Legal proceedings and sentences
Ryan pleaded guilty in April to charges of extortion involving threats to destroy a protected computer and intentional destruction of a protected system. Although the original complaint accused him of wire transfer fraud, this was not included in the charge to which he eventually pleaded guilty. He faced penalties of up to five years for extortion and up to ten years for vandalism, but the final total sentence was set at 32 months. U.S. District Judge Michael A. Shipp in Trenton, New Jersey Shipp) made this ruling.
The case highlights the increasing technical complexity and internal risks faced by companies as cyber attacks become increasingly complex. When critical infrastructure and administrator access are compromised, monitoring the situation is critical.
