The Department of Justice has indicted two Canadian nationals for allegedly running a multi-year hacking campaign that targeted educational institutions across the United States to mine cryptocurrency on compromised systems.
Ryan James Roach, 35, and Mathiew James Stubbings, 41, are accused of breaking into school computer networks, stealing login credentials, and installing cryptomining software on hijacked machines. Prosecutors say the scheme ran from June 2016 to December 2019.
Roach was arrested and extradited from Canada last week and appeared in federal court in Rochester, New York, on Tuesday. The Justice Department said it is still working to secure Stubbings’ extradition through Canadian courts.
How the attacks worked
According to prosecutors, Roach and Stubbings specifically targeted U.S. educational institutions known to operate supercomputers, researching security vulnerabilities in victim networks before gaining access. The pair reportedly used a variety of methods to break in, including leveraging a server and computers compromised from a separate victim to mask their identities.
The two allegedly routed their activity through virtual private servers located in several European countries. Victim institutions were located in New York, Tennessee, North Carolina, and Massachusetts. At the height of the operation, the men had ten computers running cryptomining software on their behalf, according to the indictment.
Charges and penalties
Both men face a maximum of 10 years in prison on charges including conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer.
Part of a broader extradition push
The case reflects an accelerating pace of U.S. arrests and indictments of alleged cybercriminals as more countries grow willing to extradite suspects. Last week, two Ghanaian nationals pleaded guilty to charges tied to running an international criminal organization that stole more than $100 million from victims through romance scams and business email compromise schemes. Those two were part of a larger group extradited from Ghana last year following nearly a decade of attacks on U.S. businesses.
