Security Affairs reports US charges over university supercomputer hacks
Security Affairs reports the DoJ alleges two Canadian men hacked US university computers to mine crypto; review credentials and load.
- Published
- Exploitation
- Not confirmed. These are unproven DoJ allegations, as relayed by Security Affairs, about intrusions from June 2016 to December 2019. No CVE is named.
What happened
According to Security Affairs, a Canadian man, Ryan James Roach (35), was extradited to the United States on October 28 to face federal charges. Security Affairs reports that he is charged alongside Mathiew James Stubbings, 41, of Ontario. The charges are allegations only. Security Affairs quotes the DoJ as saying a charge “is merely an accusation” and the defendant is presumed innocent until proven guilty.
Security Affairs, citing the DoJ, says the indictment alleges that from June 2016 to December 2019 the two men hacked computers, stole login details and used victims’ machines to mine cryptocurrency for themselves. According to the DoJ as quoted by Security Affairs, they used virtual private servers in multiple countries, registered under false names, to send malware and mining software to victim computers and to store stolen credentials.
Security Affairs reports that victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts, and that prosecutors say the pair targeted schools with supercomputers. Some affected computers were at a higher-education institution in the Western District of New York. The institutions are not named in the source.
Security Affairs also says the indictment describes the pair looking for weaknesses in victim networks, using servers and compromised machines from one victim to hide their tracks, and moving through networks once inside.
According to Security Affairs, the charges are:
- conspiracy to obtain information from and damage protected computers
- obtaining information from a protected computer
- intentional damage to a protected computer
Each carries up to 10 years in prison and a $250,000 fine. Prosecutors also allege the pair damaged at least 10 protected computers in one year and caused at least $5,000 in losses.
Security Affairs says Roach appeared before U.S. Magistrate Judge Mark W. Pedersen and is held pending a detention hearing. Extradition proceedings for Stubbings continue in Canada.
Am I affected?
Not confirmed for any specific organization. The source does not name the victim institutions. It also gives no malware names, indicators of compromise, vulnerabilities or CVEs. Only a single outlet, Security Affairs, carries the story in the material provided, and it relays the DoJ statements.
The activity described is dated June 2016 to December 2019. The source does not say whether any of it is ongoing. Education and research computing teams may want to review their own environments, but nothing in the source ties the allegations to a particular product or configuration.
What to do now
- Treat this as an unproven allegation. Do not draw conclusions about specific institutions from it; the source names none.
- Following the advice Security Affairs gives in its own commentary, watch for unusual processing load on high-performance and research systems.
- Also following Security Affairs, treat credential theft as a serious incident, not a nuisance, and patch quickly.
- Follow the case through official DoJ and court channels. Security Affairs reports that Roach’s detention hearing is pending and that Stubbings’ extradition proceedings continue in Canada.