Two Canadian men have been indicted in the United States over allegations that they hacked university networks, stole data and login credentials, and installed cryptocurrency-mining malware. If convicted, each could face up to 10 years in prison and a $250,000 fine.
The defendants, Ryan James Roach, 35, and Mathiew James Stubbings, 41, are charged with conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentionally damaging a protected computer.
According to court documents, the alleged activity took place from June 2016 to December 2019. Prosecutors say the pair used virtual private servers in several countries, registered under false names, to deliver malware to networks at unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts. The US Department of Justice said the servers also carried cryptocurrency-mining software and stored stolen login credentials.
After gaining access, Roach and Stubbings allegedly stole information, deployed mining malware, and researched security vulnerabilities. In some cases, prosecutors say, they accessed supercomputers on the institutions' networks. The DOJ said the defendants used compromised computers and other methods to conceal their identities, conduct reconnaissance, and expand their access.
Prosecutors also allege that the men damaged at least 10 computers over the course of a year, causing losses of at least $5,000.
Roach was extradited from Canada to the United States on October 28 and appeared in court ahead of a detention hearing on November 3. Stubbings is expected to be arraigned following his extradition from Canada.
Sources: BleepingComputer.