Canadian Hacker Extradited to US for Allegedly Targeting Universities' Supercomputers in Crypto Scheme

Extradition and Charges

A man from Canada has been extradited to the United States and is facing serious allegations linked to a computer hacking operation aimed at stealing access credentials from universities and illicitly mining cryptocurrency. The U.S. Department of Justice detailed these developments in a statement released on Tuesday.

Ryan James Roach, aged 35 and from Saskatchewan, along with 41-year-old Mathiew James Stubbings from Ontario, has been indicted by a federal grand jury in the Western District of New York. They are charged with conspiracy to illegally access information from and inflict damage on secured computers, as well as obtaining information unlawfully and causing intentional damage. If convicted, each could face up to ten years in prison and hefty fines reaching $250,000.

Details of the Hacking Operation

The indictment reveals that between June 2016 and December 2019, Roach and Stubbings targeted a range of U.S. educational institutions equipped with powerful supercomputers. Their strategy involved probing for security vulnerabilities before executing their breaches. Once they gained entry to the systems, they allegedly installed malware, harvested login credentials, and manipulated the computers to mine cryptocurrency for their own profit. Victims of their scheme reportedly include several universities in states such as New York, Tennessee, North Carolina, and Massachusetts.

The indictment asserts that the two men utilized virtual private servers located in various countries, under fictitious identities, to dispatch malware and mining applications to the compromised computers, while also securing the stolen credentials. They are said to have directed their attacks through computers of other victims to obfuscate their true identities.

Legal Proceedings and Future Implications

After being extradited from Canada on October 28, Roach had a court appearance in Rochester, New York, where he awaits a detention hearing. Meanwhile, extradition efforts concerning Stubbings continue in Canada.

This method of operation, known as cryptojacking, allows hackers to exploit others’ computer resources to mine cryptocurrency, all while the victims incur the associated costs of electricity and computer slowdown. Although the Justice Department has yet to specify which cryptocurrency was mined in this instance, privacy-focused coin Monero is commonly associated with such illicit activities due to its efficiency on standard hardware. This past August, the Dutch national cyber agency highlighted vulnerabilities in Apple’s macOS Screen Sharing function being exploited to deploy Monero mining tools on Macs.

Emerging Trends in Cybercrime

In a shift in tactics, hackers appear to be moving toward targeting access to AI models instead of relying just on cryptojacking for profit. A report released by Google's Threat Intelligence Group recently indicated that the trend may be toward "LLMJacking," where criminals hijack access to companies utilizing AI. This activity can rack up substantial cloud service charges in a matter of hours, with some organizations reportedly incurring up to $1 million in fraudulent fees before their access was cut off. Google has noted that this resale of stolen access happens through underground services referred to as "LLM Mixers."