Canadian Extradited to US Over University Supercomputer Cryptojacking Plot

A 35-year-old Canadian man is in U.S. custody on charges that he and an alleged accomplice hacked university supercomputers across four states to steal credentials and secretly mine cryptocurrency, the Justice Department announced Tuesday.

A federal grand jury in the Western District of New York indicted Ryan James Roach, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, on three counts: conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. Each charge carries a maximum of 10 years in prison and a $250,000 fine.

Roach landed on U.S. soil on October 28, extradited from Canada, and was arraigned in Rochester, New York, where he remains held pending a detention hearing. Extradition proceedings against Stubbings are still running in Canada, so the second defendant's arrival date is an open question in the case.

What did the alleged scheme involve?

Between June 2016 and December 2019, the two men targeted U.S. educational institutions that operated supercomputers, according to the indictment. They researched security weaknesses in the victims' networks before breaking in.

Once inside, prosecutors say, they deployed malware, harvested login credentials and forced the compromised machines to mine cryptocurrency for their own profit. The Justice Department did not specify which coin was mined.

Victims spanned New York, Tennessee, North Carolina and Massachusetts — among them a university based in the Western District of New York. The operational tradecraft was layered:

• Virtual private servers rented in several countries under false names carried the malware and mining software.
• The same infrastructure stored stolen login credentials.
• Attacks were routed through computers already compromised at other victims, masking the pair's identities.

The scheme fits the classic cryptojacking mold: attackers borrow other people's computing power, while victims eat the electricity costs and suffer degraded performance. Privacy coin Monero has long been a favorite for such operations because it can be mined on ordinary hardware. In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.

Why is Google flagging a shift toward LLMjacking?

Stolen computing power may be migrating to a new target. In a report published Monday, Google's Threat Intelligence Group said it expects attackers to "increasingly prioritize LLMJacking over traditional resource theft like cryptojacking" — hijacking companies' access to AI models and passing the bills on to the victims.

The economics differ sharply. Cryptojacking drains resources gradually, but LLMjacking can generate enormous cloud charges within hours. Google said incidents investigated by its Mandiant unit this year produced fraudulent charges topping $100,000 in a single day, and some organizations racked up $1 million before access was cut off.

Attackers are also industrializing distribution, reselling stolen model access through underground services that Google calls "LLM Mixers."

For Roach, the immediate timeline is procedural: a detention hearing in Rochester comes next, and Stubbings faces a continuing extradition fight in Canadian courts.