Two Canadians Charged for Hacking Multiple US Universities and Deploying Crypto‑Mining Malware
What Happened — A federal grand jury indicted Ryan James Roach (35) and Mathiew James Stubbings (41), both Canadian nationals, for a multi‑year campaign that compromised networks at several U.S. universities in New York, Tennessee, North Carolina and Massachusetts. Between June 2016 and December 2019 the defendants operated virtual‑private servers registered under false identities, used them to deliver malware and crypto‑mining software, and harvested login credentials from victim machines. The attackers exfiltrated donor and other sensitive data, damaged at least ten computers (≈ $5,000 loss), and even accessed supercomputers for vulnerability research. The DOJ alleges conspiracy to obtain and damage protected computers; both suspects face up to ten years imprisonment and $250 k fines.
Why It Matters for Trust & Control Assurance — The case underscores the need for strong identity‑and‑access controls, continuous monitoring, and auditable evidence of privileged activity.
Who Is Affected — Higher‑education institutions (research universities, colleges) and any organization that hosts high‑performance computing resources.
Recommended Actions
- Audit privileged accounts and enforce least‑privilege principles.
- Deploy multi‑factor authentication (MFA) for all remote and privileged access.
- Implement continuous logging and anomaly detection for credential‑use and crypto‑mining activity.
- Conduct a forensic review of affected systems and update incident‑response playbooks.
Technical Notes
- Attack vector: malware delivered via compromised VPS, credential theft, and lateral movement.
- Data types stolen: donor information, research data, login credentials.
- No specific CVE cited; the threat leveraged generic malware and credential‑reuse techniques.
Source: BleepingComputer