Canadian Extradited to U.S. for Cryptomining Crimes on University Supercomputers

Two Canadian nationals have been charged in a U.S. federal court for allegedly leading a multi-year cyber campaign targeting university supercomputers to facilitate cryptocurrency mining operations.

Indictment Details

Ryan James Roach, 35, from Saskatchewan, and Mathiew James Stubbings, 41, from Ontario, face federal prosecution in New York on allegations of conspiracy to obtain information and cause damage to protected computers, obtaining information from a protected computer, and intentional computer damage.

Legal Proceedings

Roach was transferred to U.S. custody on October 28, while Stubbings remains under extradition proceedings in Canadian courts.

Cyberattack Timeline and Methods

The indictment details a cyberattack operation spanning from June 2016 to December 2019, during which the suspects infiltrated academic institutions in New York, Massachusetts, North Carolina, and Tennessee.

Technical Tactics

The attackers established a transnational virtual private server network using falsified identities to orchestrate the campaign. These servers deployed malicious software and cryptocurrency mining tools to victim systems while also storing stolen authentication credentials.

Targeted Infrastructure

The threat actors specifically targeted university infrastructure housing supercomputers, leveraging previously compromised devices as intermediaries to obscure their activities.

Financial Motives and Impact

According to court documents, the attackers repurposed the hijacked computing resources to mine Electroneum, a cryptocurrency, using the universities’ high-performance hardware.

Advanced Techniques

Prosecutors noted that once inside a network, the suspects employed advanced techniques and tools to map internal systems, escalate privileges, and maintain persistent access. The indictment highlights the use of sophisticated reconnaissance methods to expand their foothold within the targeted institutions.

Legal Consequences

If convicted, the defendants could face up to 10 years in prison and a $250,000 fine for each charge.

Broader Implications

The case underscores the growing threat of cybercriminals exploiting academic and research institutions for financial gain through unauthorized resource utilization. The U.S. Department of Justice emphasized the severity of the offenses, citing the damage inflicted on protected systems and the unauthorized extraction of sensitive data.

Investigation and Challenges

The investigation revealed that the attackers relied on a combination of phishing tactics, credential harvesting, and network pivoting to achieve their objectives. The scale of the operation and the use of cross-border infrastructure highlight the challenges of prosecuting cybercrime in an increasingly globalized digital landscape.

About Author

Anuj

See author's posts