Unless somebody is watching processor load across a campus, a hijacked supercomputer looks like a busy one. That is roughly what prosecutors say happened at four US universities over three and a half years.
Ryan James Roach, 35, was extradited from Canada on October 28 and arraigned in the Western District of New York. A grand jury indicted him and Mathiew James Stubbings, 41, of Ontario, in April 2022.
What the indictment describes
The two men are accused of researching which universities ran powerful systems with exploitable weaknesses, then moving in from virtual servers rented under false identities in Europe and the United States. From those, they deployed malware and rootkits, pulled credentials and pushed mining software onto the machines.
Victims were spread across New York, Tennessee, North Carolina and Massachusetts. Prosecutors wrote that at least one supercomputer mined coin for the pair, leaving much of its capacity unavailable to the institution paying for it. The government has not put a figure on the proceeds.
The detection gap
The campaign ran from June 2016 to December 2019 and only surfaced through federal investigation. Research computing is built to absorb bursts of sustained load, so the signal that would flag a mining operation on a laptop is close to invisible here.
Each count carries up to ten years and a $250,000 fine, with forfeiture of hardware and proceeds. Stubbings remains in Canada while extradition proceeds.
