Canadian extradited to US in crypto mining hack targeting 4 universities

A Canadian citizen has been extradited to the United States on charges of orchestrating cyber attacks on university computer systems to steal login information and mine cryptocurrency without authorization, according to a statement from the US Department of Justice.

Charges in Multi-State University Cyberattack

Federal prosecutors said Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, targeted American educational institutions equipped with supercomputers in four states between 2016 and 2019. A federal grand jury in the Western District of New York indicted both men on charges including conspiracy to obtain and damage information from protected computers, obtaining such information unlawfully, and intentional damage to protected systems. Each charge carries a maximum penalty of 10 years in prison and a $250,000 fine.

Authorities allege that Roach and Stubbings conducted research into security vulnerabilities at prominent US universities prior to launching their attacks. After breaching these networks, they allegedly installed malware designed to steal login credentials and directed the compromised computers to mine cryptocurrency for their personal gain.

The victims included universities in New York, Tennessee, North Carolina, and Massachusetts. According to prosecutors, among the targeted educational institutions was a university in the Western District of New York. The attackers purportedly deployed virtual private servers registered with false identities in several countries to launch malware and mining software. Investigators believe the pair masked their tracks by routing attacks through additional compromised machines to obscure their origins.

Roach was extradited from Canada on October 28 and arraigned in Rochester, New York, where he remains in custody pending a detention hearing. Extradition proceedings are ongoing for Stubbings, who is still in Canada.

Victims cited by prosecutors included multiple universities in New York, Tennessee, North Carolina, and Massachusetts, with attackers allegedly using a network of falsely registered virtual private servers and compromised computers to carry out and hide the cryptojacking scheme.

The Justice Department did not specify which cryptocurrency was mined, but clarified that the scheme relied on commandeering university computing resources, with the victims saddled with electricity costs and reduced system performance.

Mini dictionary: Cryptojacking, a cyberattack that covertly uses another user’s computing resources to mine cryptocurrency, commonly results in higher energy costs and slower device performance for the victim.

Screen Sharing Flaw Targets Apple macOS Users

Separately, authorities in the Netherlands warned that hackers have exploited a vulnerability in Apple’s macOS Screen Sharing feature, allowing unauthorized access to affected devices. The Dutch National Cyber Security Center (NCSC) issued an updated advisory this week after receiving multiple reports of active incidents targeting systems with exposed port 5900, which enables Screen Sharing over the internet.

Attackers have leveraged this flaw to install cryptocurrency mining software on compromised Macs without the users’ knowledge. The NCSC urged system administrators to restrict internet access to the affected port and implement security patches to mitigate risks.

From Cryptojacking to LLMjacking: Emerging Cyber Threats

Meanwhile, Google’s Threat Intelligence Group reported a shift in cybercriminal techniques, stating that attackers are increasingly focusing on hijacking access to AI models, a tactic labeled “LLMjacking.” Instead of stealing computing power for mining, these attackers gain unauthorized access to companies’ AI resources, saddling victims with substantial cloud computing fees.

Google’s Mandiant unit observed that some organizations suffered fraudulent cloud charges exceeding $100,000 in a single day, with totals reaching $1 million before their access was revoked. According to the report, perpetrators resell this stolen access through underground networks known as “LLM Mixers,” accelerating the financial impact.

Mini dictionary: LLMjacking, or Large Language Model jacking, refers to a cyber attack where malicious actors hijack access to companies’ advanced AI models, such as GPT or similar systems, running on high-cost cloud platforms, shifting the computational expense to the victimized organizations.