Crypto’s Notepad Ninjas Allegedly Turned University Supercomputers Into Free Miners 🖥️

Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, were indicted in the Western District of New York over an alleged scheme to compromise university supercomputers and secretly mine cryptocurrency, the Justice Department said Tuesday.

The federal grand jury charged the pair with conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine. Between June 2016 and December 2019, prosecutors said, the defendants targeted U.S. educational institutions with supercomputers, researching security weaknesses before breaking into their networks.

The Justice Department alleged that the pair deployed malware, stole login credentials and forced victims’ computers to mine cryptocurrency for their benefit. Affected institutions included organizations in New York, Tennessee, North Carolina and Massachusetts, including a university in the Western District of New York. According to the indictment, the defendants used virtual private servers in several countries under false names to distribute malware and mining software, store stolen credentials and route attacks through other compromised computers to conceal their identities.

Roach was extradited from Canada on October 28 and arraigned in Rochester, New York, where he was held pending a detention hearing. Extradition proceedings against Stubbings are continuing in Canada. The Justice Department did not identify the cryptocurrency allegedly mined.

The scheme is known as cryptojacking, in which attackers use other people’s computers to mine cryptocurrency while victims bear the electricity costs and slower performance. In August, the Netherlands’ National Cyber Security Center, or NCSC, warned that attackers were exploiting a vulnerability in Apple’s macOS Screen Sharing feature to install Monero miners on internet-exposed systems, including machines with port 5900 exposed.