The Justice Department says that allegation is part of a multi-year scheme in which two Canadian nationals broke into university networks, stole credentials, and installed malware to turn university computing resources into a furtive cryptocurrency-mining farm. The indictment, unsealed by prosecutors, traces the alleged activity to between mid‑2016 and late‑2019 and identifies at least four U.S. universities — located in New York, Tennessee, North Carolina and Massachusetts — as compromised targets.
Allegations against Ryan James Roach and Mathiew James Stubbings
Federal prosecutors charged Ryan James Roach and Mathiew James Stubbings in an indictment returned by a grand jury in April 2022. The document alleges the two men researched and identified potential victims with supercomputers that contained exploitable vulnerabilities, gained unauthorized access, and deployed malware to commandeer processing power for cryptocurrency mining.
According to the unsealed indictment and court filings cited by officials, Roach, a 35‑year‑old from Saskatchewan, Canada, was extradited to the United States on Oct. 28 and was arraigned in the U.S. District Court for the Western District of New York. Prosecutors said they are still seeking the extradition of Stubbings, a 41‑year‑old from Ontario, Canada. If convicted on the charged cybercrimes, the men each face up to 10 years in prison and up to a $250,000 fine, and are ordered to forfeit networking and data storage devices as well as any property or proceeds obtained through the alleged scheme.
Targets: supercomputers at universities in New York, Tennessee, North Carolina and Massachusetts
The indictment identifies at least four universities across four states as victims. Prosecutors say the defendants specifically targeted systems that included supercomputers or high‑performance computing resources and that they deployed software to turn those systems into mining rigs.
Officials emphasized the operational impact: at least one supercomputer’s processing speed and power were rendered largely unavailable to its legitimate owner while it was being used to mine cryptocurrency. The indictment does not quantify the amount of cryptocurrency allegedly mined or the total financial value obtained through the activities.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTactics described in the indictment: credentials, rootkits, and rented servers
Prosecutors allege a combination of reconnaissance and concealment tactics. The indictment states the defendants stole credentials and data from compromised machines, installed malware and rootkits on those systems, and transmitted cryptocurrency mining software to take over processing power. To hide the activity and the flow of traffic, the men allegedly rented virtual private servers located in Europe and the United States under false identities.
Those rented servers, according to the filing, were used to conceal traffic, deploy rootkits, and facilitate the transmission of mining software and stolen credentials. The charging document frames these steps as part of a coordinated conspiracy to exploit vulnerable high‑performance systems for unauthorized financial gain.
What this means for technologists, university IT teams, and prosecutors
- Technologists and security teams: The indictment highlights a toolkit that combines credential theft, rootkits, and the use of rented virtual private servers to obscure traffic. Logs that show sustained high CPU/GPU utilization, unexplained outbound connections to foreign VPS hosts, or indicators of rootkit activity are specifically consistent with the techniques prosecutors describe.
- University IT teams and administrators: The alleged consequences include meaningful loss of access to supercomputing resources and the diversion of processing power to unauthorized cryptocurrency mining, a concrete operational and research disruption named in the indictment.
- Prosecutors and law enforcement: The case shows ongoing use of extradition and traditional criminal statutes in response to alleged cross‑border cybercrime. A grand jury indictment was returned in April 2022, one defendant was extradited and arraigned after an Oct. 28 transfer, and authorities are continuing extradition efforts for the second defendant.
The criminal case now proceeds in federal court for the Western District of New York, with one defendant arraigned and another still a subject of extradition efforts. Prosecutors have laid out a chain of alleged actions — from target identification to credential theft, rootkit deployment and the use of rented servers to conceal mining — but they have not disclosed the total amount of cryptocurrency or proceeds allegedly obtained. The coming weeks will determine whether the evidence in court matches the contours of the indictment and whether additional victims or losses will be disclosed as part of the litigation.
