insider threat6 articles
How US Air Force Pilots Flew Missions With Malware-Infected USB Sticks From Kabul Bazaars
In the early 2000s, US Air Force pilots in Afghanistan routinely used USB drives purchased from local vendors — sometimes in cities like Kabul — interchangeably across both classified and unclassified systems when planning missions, creating serious security vulnerabilities. Junior IT security staff who raised concerns were largely ignored by senior officers who didn't fully understand the risks of transferring malware between systems via removable media. This practice had serious consequences, as adversaries began planting infected USB drives with local vendors, ultimately contributing to the 2008 Agent.BTZ malware infection of the Department of Defense, which took 14 months to eradicate.
OpenAI Engineer Arrested After Bugging Conference Room with Hidden Recording Device
An OpenAI engineer, identified as 35-year-old Saudi national Abdulrahman Alfozan, was arrested after secretly planting an audio recording device inside a company conference room in an apparent attempt to capture sensitive conversations. The device was discovered on September 30, hidden in toilet paper and inserted into a USB port on a television, after which OpenAI used its own AI models to identify Alfozan as the culprit and reported the matter to the FBI. OpenAI stated there is no indication that the employee improperly accessed or stole model weights, source code, or customer data, and he has since been fired and charged with illegally intercepting oral communications.
Infrastructure Engineer Gets 32 Months for Trying to Ransom His Own Employer
Daniel Rhyne, a 59-year-old infrastructure engineer at a New Jersey industrial firm, was sentenced to 32 months in federal prison for sabotaging his own company's systems and attempting to extort $750,000 in bitcoin. In November 2023, he used scheduled tasks to lock administrators out of thousands of accounts and servers, then sent a ransom demand threatening to shut down 40 servers per day unless payment was made. The FBI traced the attack to Rhyne's residential IP address through internal logs and forensic analysis, leading to his arrest and eventual guilty plea.
Nobody Revoked His Access. He Noticed.
A terminated employee caused hundreds of thousands of dollars in damage and significant project delays after their company failed to revoke their system access, allowing them to delete files, lock out accounts, and corrupt a database. The lapse occurred because HR and IT each assumed the other was responsible for cutting off access, leaving the former employee's credentials active for several days. The incident highlights the need for clear offboarding protocols, including same-day access revocation and regular reviews of shared admin credentials.
The Guy Hired to Catch Spies Was Busy Being One
Nathan Vilas Laatsch, a 29-year-old IT specialist who worked in the DIA's Insider Threat Division, pleaded guilty after being caught in an FBI sting operation passing classified information to what he believed were foreign spies. Ironically, his role at the DIA involved identifying potential leakers and supporting internal investigations, knowledge he intended to exploit to avoid detection. He was arrested in May 2025 after making two dead-drops of top-secret documents in an Arlington, Virginia park, having transcribed the classified information by hand and hidden the notes in his socks.
Myspace93 Breach: 46,000 Plaintext Passwords Finally Surface, Five Years Late
In January 2021, Myspace93 — a parody site mimicking the old social network — suffered a breach in which trusted members of a Discord community exploited beta app access to steal server files, including an unencrypted store containing the plaintext usernames, passwords, email addresses, and IP addresses of over 46,000 users. The site's co-creator, known as jankenpopp, blamed the betrayal on individuals he considered close collaborators, who concealed the theft and shared stolen data and download tools among themselves. The breach has only recently been highlighted after HaveIBeenPwned ingested the data more than five years later, and affected users are advised to change any reused passwords and enable two-factor authentication.