Canadian Man Extradited to US Over Plot to Hijack University Supercomputers for Crypto

A Canadian man has been extradited to the United States to face charges that he helped hack into university computers to steal login credentials and secretly mine cryptocurrency, the Justice Department said on Tuesday.

A federal grand jury in the Western District of New York indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine.

Between June 2016 and December 2019, the pair targeted U.S. educational institutions with supercomputers, researching security weaknesses in their networks before breaking in, according to the indictment. Once inside, they allegedly deployed malware, stole login credentials and forced the victims' computers to mine cryptocurrency for their own benefit.

Victims included institutions in New York, Tennessee, North Carolina and Massachusetts, among them a university in the Western District of New York, prosecutors said. The pair allegedly used virtual private servers in several countries, registered under false names, to send malware and mining software to victim computers and store stolen credentials, and routed attacks through computers compromised at other victims to hide their identities.

Roach was extradited from Canada on October 28 and arraigned in Rochester, New York, where he was held pending a detention hearing. Extradition proceedings against Stubbings are continuing in Canada.

From cryptojacking to LLMjacking

The scheme is a form of cryptojacking, in which attackers use other people's computers to mine crypto while the victims bear the electricity costs and slower performance. The Justice Department did not say which cryptocurrency the pair allegedly mined.

Privacy coin Monero has long been a favorite for such schemes because it can be mined on ordinary hardware. In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.

But hackers looking to profit from stolen computing power may be turning elsewhere. In a report published Monday, Google's Threat Intelligence Group said it expects attackers to "increasingly prioritize LLMJacking over traditional resource theft like cryptojacking," hijacking companies' access to AI models and passing on the bills.

Unlike the gradual drain of cryptojacking, LLMjacking can run up huge cloud charges within hours, Google said. In incidents investigated by its Mandiant unit this year, fraudulent charges topped $100,000 in a single day, and some organizations racked up $1 million before access was cut off. Attackers are reselling stolen access through underground services that Google calls "LLM Mixers."