~# cat ep4/notes.md

30:35

#EP 4

ShinyHunters Arrests, the Accenture Patch Failure, and a Rogue Engineer

Insider threat from two directions: an engineer who locked 3,000 machines on his own employer's network, and a contractor who missed one patch. Plus two ShinyHunters arrests, and why an arrest is not a shutdown.

Watch on YouTube

Last episode we declined to say whether the FBI was patched or whether a new zero-day was involved, because nobody could know. This week the FBI answered part of that. Two of tonight’s three stories are about trusted insiders failing, and that is where the weight of the episode sits.

The engineer who locked 3,000 machines

The case (court records)

  • Daniel Rhyne, 57, of Kansas City, Missouri, a former core infrastructure engineer at a New Jersey industrial company, was sentenced to 32 months for a ransomware-style attack on his own employer’s network. He pleaded guilty.
  • Per court documents, between November 8 and 25, 2023 he used an admin account to remotely access the network and set scheduled tasks on the domain controller that changed the admin password, deleted 13 domain admin accounts, and changed passwords on 301 domain user accounts.
  • More scheduled tasks locked 254 servers and 3,284 workstations, and shut down random machines over several days.
  • On November 25 he emailed a ransom demand titled “Your Network Has Been Penetrated,” claimed backups were deleted, and threatened to shut down 40 servers a day for ten days unless the company paid 20 bitcoin, roughly $750,000 at the time.
  • Investigators found he had searched, on a hidden VM and earlier on his laptop, for how to change local admin passwords remotely, delete domain accounts, clear Windows logs, and remotely shut down a computer. The intent is on the record in his own search history.

Why it matters

The access was legitimate. No perimeter to breach, no CVE, no phishing email. Every control that stops an outside attacker at the edge does nothing against an engineer who already holds domain admin. You can be fully patched and fully monitored at the edge and still lose the whole estate to one trusted person with too much reach and nobody watching.

It is not a one-off. In March, Cameron Curry, a 27-year-old contractor, got two years for extorting his employer Brightly Software for $2.5 million.

CIS Controls:

  • 6, Access Control Management. One engineer could rewrite passwords across the domain and delete admin accounts. That is a blast-radius problem. No single account should be able to take down the whole estate.
  • 8, Audit Log Management. He tried to clear Windows logs, which is the tell. Logs shipped off-box in real time, where a local admin cannot reach them, survive this. On-box logs an insider can wipe are not evidence.
  • 5, Account Management. Scheduled tasks as a timer is classic insider tradecraft. Regular review of scheduled tasks on domain controllers and of privileged accounts is the unglamorous control that catches it.
  • 11, Data Recovery. He claimed to have deleted backups. Offline or immutable backups a privileged insider cannot delete are the difference between a bad week and a company-ending event.
  • For MSPs: this is the “what if your own tech goes rogue” scenario. Separation of duties and break-glass procedures are what limit how much damage one trusted person can do.

The Accenture patch failure

What the FBI said (on record)

  • FBI cyber chief Brett Leatherman said the incident resulted from a security failure on a platform managed by a third-party organization, after a contractor failed to implement a security patch issued to secure that platform.
  • The FBI said it removed the contractor and took steps to mitigate further risk and protect its workforce.
  • The FBI’s statement confirms a patching failure. It does not name the platform or the contractor, and it does not endorse ShinyHunters’ technical claims about how they got in.

What Reuters’ sources added (unnamed sources)

  • Two people familiar with the matter told Reuters the platform is Oracle PeopleSoft and the third party is Accenture.
  • Accenture told Reuters it was proud to support the FBI’s mission, but did not address the contractor or the missed patch.
  • Other outlets tie it to CVE-2026-35273, the PeopleSoft bug from EP3. That link is reporting, not FBI confirmation.

Why it matters

The engineer abused trusted access on purpose. The contractor failed a trusted responsibility by omission. Both are failures inside the trust boundary. It is also the cleanest patch-management story of the year: a vendor issued a fix, someone was responsible for applying it, it did not get applied, and the result was a breach of data on nearly every FBI agent. The breach the industry was speculating about turned out to be a missed patch, not exotic tradecraft.

CIS Controls:

  • 7, Continuous Vulnerability Management. When a platform is managed by a third party, patching responsibility has to be explicitly owned in the contract. Who patches, and who verifies it landed, should be written down. “We assumed the vendor had it” is how this happens.
  • 15, Service Provider Management. Your risk does not disappear when you hand a system to a contractor. It moves to someone you now have to hold accountable.

KEV follow-up

The Citrix NetScaler zero-days from EP3 are now in the CISA KEV catalog. CVE-2026-88771 and CVE-2026-88772 were added September 27 with a September 30 federal patch deadline that has passed, and CVE-2026-88779 was added October 4.

Two ShinyHunters arrests

  • Netherlands: on September 29 the FBI and Dutch National Police announced the arrest of Pepijn van der Stap, released this year after serving time on a prior hacking conviction. Krebs reported he was a key ShinyHunters figure.
  • Jordan: FBI sources told Reuters that Saif al-Din Khader was arrested in Jordan on September 28 and is cooperating with the FBI to locate other members. Krebs had identified Khader last November as the figure behind the handle “Rey.”
  • The two were reportedly in a power struggle for control of the operation.
  • The FBI says it continues to investigate, has worked with partners to arrest multiple subjects, and will spare no resource.

An arrest is not a shutdown

We said it last week, before either arrest was public. The leak site was taken down, allegedly by law enforcement, and the group resurfaced on Telegram saying it would restart a long-defunct forum. ShinyHunters also told outlets it would not release the stolen FBI data. That is the group’s claim, not a resolution. Two arrests, one cooperating, is real pressure. It is not the end of the group.

The takeaway

Three stories, one spine: trust, and who holds it. The most dangerous access is the access you already granted. Patch the things, limit who can touch what, and keep logs where the person causing the problem cannot erase them.

Sources