A US federal grand jury has indicted two Canadians — Ryan James Roach, 35, and Mathiew James Stubbings, 41 — over an alleged campaign that infected computer networks at multiple unnamed educational institutions in New York, Tennessee, North Carolina and Massachusetts between June 2016 and December 2019. Court documents allege the pair used virtual private servers registered under fake names to transmit malware and mining software to victim computers and to store stolen login credentials, then used the compromised systems — including high-performance supercomputers — for reconnaissance, credential theft, crypto-mining and vulnerability research, damaging at least 10 computers and causing losses of at least US$5,000. Each faces a maximum of 10 years in prison and a US$250,000 fine for conspiracy to obtain information from and damage protected computers. Roach was extradited from Canada on 28 October and arraigned on 3 November; Stubbings is to be arraigned after his extradition. The case is a reminder that higher-education research infrastructure remains a magnet for credential theft and cryptomining abuse.

• Source article