Hackers Extradited for Cryptojacking Supercomputer Breach Across US Universities
What Happened — Two Canadian nationals were charged in the United States for infiltrating university supercomputing clusters between June 2016 and December 2019. The suspects stole privileged credentials, moved laterally across campus networks, and deployed cryptocurrency‑mining malware on high‑performance machines. At least one supercomputer was repurposed to mine Electroneum, rendering the research node unavailable and causing an estimated $5 K loss. The attackers used bullet‑proof VPS rentals and compromised third‑party hosts to hide their command‑and‑control infrastructure. One suspect has been extradited; the second remains under extradition proceedings.
Why It Matters for Trust & Control Assurance — The incident highlights the need for strong identity and access controls, continuous credential monitoring, and evidence‑based audit readiness.
Who Is Affected — Higher‑education and research institutions that operate high‑value compute resources.
Recommended Actions —
- Conduct a credential‑access review for all privileged accounts; enforce MFA and least‑privilege principles.
- Deploy continuous monitoring of compute workloads to detect unauthorized crypto‑mining or anomalous CPU usage.
- Strengthen network segmentation and logging to provide defensible evidence for audit and incident response.
Technical Notes — Attackers leveraged stolen admin credentials and mis‑configured network services to gain footholds. No specific CVE was disclosed; the vector was credential compromise combined with inadequate segmentation. Malware installed a cryptomining payload that harvested CPU cycles from the supercomputers. Source: DataBreachToday