Two Canadians Indicted for Hacking US Universities to Mine Cryptocurrency on Supercomputers
A US federal grand jury has indicted Ryan James Roach (35) and Mathiew James Stubbings (41), two Canadian nationals, for allegedly hacking multiple US universities between June 2016 and December 2019 and deploying cryptocurrency-mining malware on compromised systems, including supercomputers. The pair face charges of conspiracy to obtain information from and damage a protected computer, intentionally damaging a protected computer, and obtaining information from a protected computer, carrying up to 10 years in prison and a $250,000 fine each if convicted. Victims included unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts, and prosecutors say the defendants caused at least $5,000 in damage to at least 10 computers over a one-year period. Roach was extradited from Canada on October 28, 2026 and arraigned on November 3; Stubbings awaits extradition.
Detalhes técnicos
According to the Department of Justice, Roach and Stubbings used virtual private servers registered under fake names in multiple countries to distribute malware and crypto-mining software, and to store stolen login credentials. After gaining initial access, the attackers conducted reconnaissance, stole data and credentials, deployed mining malware, and in some cases used compromised supercomputer access to research security vulnerabilities in victim networks. They reportedly used compromised computers and servers belonging to other victims to conceal their identities while expanding access across networks.
Linha do tempo
-
Two Canadians Indicted for Hacking US Universities to Mine Cryptocurrency on Supercomputers
ler a análise desta fonte ocultar
A US federal grand jury has indicted Ryan James Roach (35) and Mathiew James Stubbings (41), two Canadian nationals, for allegedly hacking multiple US universities between June 2016 and December 2019 and deploying cryptocurrency-mining malware on compromised systems, including supercomputers. The pair face charges of conspiracy to obtain information from and damage a protected computer, intentionally damaging a protected computer, and obtaining information from a protected computer, carrying up to 10 years in prison and a $250,000 fine each if convicted. Victims included unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts, and prosecutors say the defendants caused at least $5,000 in damage to at least 10 computers over a one-year period. Roach was extradited from Canada on October 28, 2026 and arraigned on November 3; Stubbings awaits extradition.
Technical Details
According to the Department of Justice, Roach and Stubbings used virtual private servers registered under fake names in multiple countries to distribute malware and crypto-mining software, and to store stolen login credentials. After gaining initial access, the attackers conducted reconnaissance, stole data and credentials, deployed mining malware, and in some cases used compromised supercomputer access to research security vulnerabilities in victim networks. They reportedly used compromised computers and servers belonging to other victims to conceal their identities while expanding access across networks.