Article
[Canadian Man Extradited to U.S. for Hijacking U.S. University Supercomputers to Mine Cryptocurrency]
The U.S. Department of Justice said Tuesday that a Canadian man has been extradited to the United States to face charges of aiding in the intrusion of university computers, stealing login credentials, and secretly mining cryptocurrency. A federal grand jury in the Western District of New York indicted 35-year-old Saskatchewan resident Ryan James Roach and 41-year-old Ontario resident Mathiew James Stubbings on counts including conspiracy to obtain and damage protected computer information, obtaining protected computer information, and intentionally damaging protected computers, which carry a maximum penalty of 10 years in prison and a $250,000 fine. According to the indictment, between June 2016 and December 2019, the two targeted U.S. educational institutions with supercomputers, first researching their cybersecurity weaknesses before carrying out intrusions. After gaining access to the systems, they allegedly deployed malware, stole login credentials, and forced victims’ computers to mine cryptocurrency on their behalf. Victims included institutions in New York, Tennessee, North Carolina, and Massachusetts. The pair reportedly used virtual private servers registered under false names in multiple countries to send malware and mining programs and store stolen credentials, and also relayed attacks through other victims’ compromised computers to conceal their identities. Roach was extradited from Canada on October 28 and appeared in court in Rochester, New York; he is currently being held pending a detention hearing, while extradition proceedings against Stubbings are still ongoing in Canada. This case falls under cryptojacking—the practice of attackers using others’ computers to mine cryptocurrency, with victims bearing the electricity costs and suffering performance degradation—and the Justice Department did not specify which particular coins the two mined. Google’s Threat Analysis Group released a report Monday predicting that attackers will increasingly prioritize LLMjacking over traditional resource theft methods like cryptojacking—hijacking enterprises’ access to AI models and passing on the resulting bills.