Canadian Nationals Extradited for Hijacking University Supercomputers for Cryptomining
Two Canadian men have been indicted in the US for allegedly using university supercomputers to mine cryptocurrency, highlighting the ongoing threat of cryptojacking.
Two Canadian nationals, Ryan James Roach and Mathiew James Stubbings, are facing federal prosecution in New York for their alleged involvement in a multi-year cybercrime campaign. The indictment, unsealed recently, details how the pair allegedly hijacked high-performance computing resources at several American universities between June 2016 and December 2019.
Roach, 35, from Saskatchewan, has already been extradited from Canada to the United States on October 28. Extradition proceedings for Stubbings, 41, of Ontario, are still ongoing in Canadian courts. The charges include conspiracy to obtain information and cause damage to protected computers, obtaining information from a protected computer, and intentional computer damage. If convicted, they face a maximum of 10 years in prison and a $250,000 fine for each count.
The indictment alleges that Roach and Stubbings established a complex, multi-country virtual private server (VPS) infrastructure using fraudulent identities to manage their illicit operations. These servers were instrumental in transmitting malware and cryptocurrency mining software to the compromised victim computers. Furthermore, the infrastructure was used to store stolen login credentials, facilitating further network access and control.
The attackers specifically targeted academic institutions that housed supercomputers, recognizing their immense processing power. They leveraged previously compromised machines as pivot points to obscure their true origins and make their activities harder to trace. This tactic is common among sophisticated threat actors seeking to maintain anonymity while conducting prolonged campaigns.
Canadian court documents have revealed that the hijacked university hardware was repurposed to mine a specific cryptocurrency known as Electroneum. This choice of cryptocurrency may have been influenced by its mining difficulty, profitability, or the ease with which it could be laundered.
Prosecutors stated that once inside a target network, Roach and Stubbings employed sophisticated techniques and tools to conduct reconnaissance, identify vulnerabilities, and expand their access within the compromised systems. This methodical approach allowed them to maximize their use of the university's computing power for their own financial gain.
This case underscores the persistent threat of cryptojacking, where attackers illicitly use others' computing resources to mine cryptocurrencies. Universities, with their high-performance computing clusters, represent particularly attractive targets due to the significant processing power available, which can generate substantial profits for threat actors.
The ongoing prosecution and extradition highlight the international cooperation required to combat cybercrime. The lengthy timeframe of the alleged intrusions, spanning nearly four years, also points to the challenges law enforcement faces in detecting and attributing such sophisticated, long-term attacks.