Canadian Man Extradited to U.S. Over University Hacking and Cryptojacking Scheme

Federal law enforcement authorities in the United States have secured the extradition of a Canadian national to face serious criminal charges connected to an extensive, multi-year cyber espionage and cryptojacking conspiracy. According to announcements made by the U.S. Department of Justice on Tuesday, the accused individual was brought across the border to answer for allegations that he, alongside a co-conspirator, deliberately targeted higher education institutions in the United States to infiltrate powerful academic computing networks, steal administrative login credentials, and clandestinely siphon computational resources to mine cryptocurrency for their own personal financial gain.

The legal proceedings stem from an indictment returned by a federal grand jury sitting in the Western District of New York. The charging documents name two primary defendants: 35-year-old Ryan James Roach, a resident of the province of Saskatchewan in Canada, and 41-year-old Mathiew James Stubbings, a resident of Ontario. Both men face a battery of federal cybercrime counts, including conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. If convicted by a federal court, the defendants face a maximum statutory penalty of up to 10 years in federal prison, alongside substantial financial penalties reaching up to $250,000 for the charged offenses.

The alleged conspiracy unfolded over a prolonged period, stretching from June 2016 through December 2019. During these three and a half years, prosecutors allege that the two men systematically targeted U.S. educational institutions that housed advanced supercomputers and high-performance research networks. Rather than deploying chaotic, indiscriminate malware, the conspirators reportedly engaged in meticulous reconnaissance. They meticulously researched specific security weaknesses and systemic vulnerabilities within university network perimeters before successfully breaking into the systems.

Once inside these protected academic environments, Roach and Stubbings allegedly deployed sophisticated malware designed to systematically harvest sensitive data. Among their primary objectives was the theft of login credentials belonging to faculty members, administrative staff, and system operators. Armed with these administrative privileges, the hackers were able to establish persistent access and force the victims’ high-powered computers to dedicate substantial processing power to mining cryptocurrency. This illicit activity yielded financial benefits for the perpetrators while leaving the targeted institutions to shoulder the exorbitant electricity bills, system slowdowns, and hardware degradation associated with continuous, intensive computational workloads.

The scope of the alleged attacks was geographically diverse, impacting prestigious educational institutions across multiple states. According to the Justice Department, the victims included universities located in New York, Tennessee, North Carolina, and Massachusetts. Among the targeted entities was at least one university situated within the Western District of New York, prompting local federal prosecutors to spearhead the investigation.

To evade law enforcement detection and obscure their true physical locations, the defendants allegedly employed a complex infrastructure of digital concealment. Prosecutors stated that Roach and Stubbings utilized virtual private servers hosted in several different foreign countries. These servers were reportedly registered under false names and were used as operational staging grounds to push malware and mining software onto victim computers, as well as to securely store stolen credentials. Furthermore, the hackers routinely routed their malicious network traffic through computers that had already been compromised at other victim institutions, creating a labyrinthine digital trail designed to obfuscate their identities and frustrate the efforts of cybersecurity investigators.

The procedural journey to bring the defendants to justice has involved cross-border cooperation between Canadian and U.S. authorities. Following the indictment, legal mechanisms were initiated to secure Roach’s return to the United States. On October 28, Roach was successfully extradited from Canada and was subsequently arraigned in Rochester, New York. Following his initial court appearance, he was ordered held in custody pending a formal detention hearing. Meanwhile, legal proceedings regarding the extradition of the second defendant, Mathiew James Stubbings, are currently ongoing within the Canadian legal system.

From Cryptojacking to LLMjacking

The illicit enterprise orchestrated by the two Canadian nationals represents a textbook example of cryptojacking—a specialized form of cybercrime where malicious actors commandeer third-party computing infrastructure to mine digital assets. In these scenarios, the victims absorb all the tangible costs, including spiking utility expenses for electricity and accelerated wear and tear on specialized hardware, while the threat actors collect the mining rewards anonymously. While the Justice Department’s public statements and court filings did not specify the exact type of cryptocurrency that Roach and Stubbings allegedly mined using the stolen university supercomputers, privacy-focused digital assets have historically been favored targets for such operations.

Privacy coins, most notably Monero, have long maintained a reputation as the preferred currency for cybercriminals engaged in unauthorized resource theft. Because Monero is engineered to be efficiently mined on ordinary or semi-specialized hardware without requiring massive, application-specific integrated circuit arrays, it offers an attractive payout for threat actors operating out of hijacked environments. The persistence of these threats across various operating systems continues to trouble cybersecurity agencies globally. For instance, earlier in the year, the Dutch national cyber agency issued a public advisory warning that malicious actors were actively exploiting a security flaw embedded within Apple’s macOS Screen Sharing feature to surreptitiously plant Monero-mining software onto vulnerable Mac computers.

However, as cybersecurity defenses against traditional cryptojacking have matured and enterprise monitoring tools have grown more adept at detecting unauthorized computational spikes, hackers seeking to monetize stolen computing power may be shifting their focus toward newer horizons. Industry experts and threat intelligence analysts suggest that the economics of cybercrime are evolving in tandem with advancements in artificial intelligence and cloud computing.

In a comprehensive threat intelligence report published recently by Google’s security researchers, analysts indicated that they expect malicious actors to increasingly prioritize a newer vector known as "LLMjacking" over traditional resource theft like cryptojacking. Rather than hijacking central processing units to mine digital coins, LLMjacking involves threat actors compromising corporate access to advanced artificial intelligence models and large language models, subsequently passing the exorbitant operational bills onto unsuspecting organizations.

Unlike cryptojacking, which often drains computing power gradually and can sometimes fly under the radar of casual system administrators, LLMjacking can inflict severe financial damage in an astonishingly short timeframe. According to Google’s findings, fraudulent charges associated with compromised AI model access can accumulate into tens of thousands of dollars within mere hours. In specific security incidents investigated by Google’s Mandiant incident response division over the course of the year, unauthorized cloud charges topped $100,000 in a single day, while some organizations found themselves facing bills totaling up to $1 million before automated safety mechanisms or security teams managed to sever the unauthorized access.

Furthermore, the underground economy supporting these attacks has evolved rapidly. Security researchers have identified underground digital services—dubbed "LLM Mixers" by Google—where threat actors resell stolen enterprise access to artificial intelligence models, mirroring the illicit marketplaces that have historically supported cryptojacking operations, ransomware distribution, and credential trafficking. As law enforcement agencies continue to clamp down on traditional infrastructure attacks like the one allegedly perpetrated against U.S. universities by Roach and Stubbings, the shifting tactics of cybercriminals underscore the continuous challenge facing institutional defenders in an increasingly digital and interconnected world.