A Canadian man has been extradited to the United States to face federal charges tied to an alleged years-long scheme targeting university supercomputers for unauthorized cryptocurrency mining.
U.S. prosecutors say Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, were charged in the Western District of New York over attacks that allegedly ran from June 2016 through December 2019. Prosecutors allege the two stole credentials, deployed malware and used compromised academic systems to mine crypto for their own benefit.
Indictment details
A federal grand jury in the Western District of New York indicted Roach and Stubbings on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer.
According to prosecutors, the charges carry a maximum penalty of 10 years in prison and a $250,000 fine. The case centers on alleged intrusions into computers at U.S. educational institutions that operated high-performance systems, including supercomputers.
How prosecutors say the scheme worked
Prosecutors allege the pair first researched weaknesses in the networks of targeted schools before gaining access to the systems. After entering the networks, they are accused of installing malware, stealing login credentials and directing the compromised machines to mine cryptocurrency without authorization.
The alleged conduct spanned more than three years. Prosecutors say the attacks were designed both to exploit the computing power of university systems and to collect credentials that could support continued access.
Universities in multiple states were affected
The alleged victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Prosecutors also said one of the affected universities was located in the Western District of New York, where the case was brought.
To support the operation, the defendants allegedly used virtual private servers in several countries that were registered under false names. Prosecutors say those servers were used to deliver malware and cryptocurrency-mining software to victim machines and to store stolen credentials.
Use of intermediaries and current status
Prosecutors further allege that the attacks were routed through computers already compromised at other victim institutions in an effort to conceal the operators' identities.
Roach was extradited from Canada on October 28 and arraigned in Rochester, New York. He was held pending a detention hearing. Extradition proceedings involving Stubbings are still underway in Canada, according to prosecutors.
What happens next
The case now moves forward in federal court in New York for Roach, while Canadian extradition proceedings continue for Stubbings. At this stage, the allegations remain accusations by prosecutors, and the next confirmed step disclosed in the case is Roach's detention process following his arraignment in Rochester.
Source: decrypt.co