Insider sabotage, not ransomware: how a Kansas City engineer used a hidden VM to lock admins out of 3,538 Windows systems
Between Nov 9 and Nov 25, 2023, Daniel Rhyne — a 57‑year‑old core infrastructure engineer — used legitimate administrator privileges and a hidden virtual machine on his company laptop to change passwords and schedule shutdowns that locked IT staff out of 254 Windows servers and 3,284 workstations. This was an insider sabotage operation that looked […]
