US university supercomputer hacking for crypto-mining: two Canadians indicted
Severity: medium · Patch status: no-fix-needed · Since 2026-11-04
A federal grand jury indicted two Canadians, Ryan James Roach (35) and Mathiew James Stubbings (41), for hacking multiple US universities between June 2016 and December 2019. Using virtual private servers registered under fake names in several countries, they transmitted malware and crypto-mining software to victim networks, stole data and login credentials, deployed crypto-mining malware, and used compromised supercomputers for vulnerability research. They concealed their identities via servers and compromised computers from other victims and used sophisticated reconnaissance to expand access. Charges carry up to 10 years in prison and a $250,000 fine each. Roach was extradited from Canada on October 28 and arraigned November 3; Stubbings awaits extradition. No CVE applies; organisations should review credential hygiene and network segmentation.
What to do
- Review and rotate credentials on supercomputing and shared research infrastructure
- Hunt for crypto-mining processes and unauthorised VPN/VPS-origin access in historical logs
- Segment research networks and monitor lateral movement from compromised hosts
- Report suspected related intrusions to law enforcement/FBI
Sources
All live incidents on Threat Watch
