Canadian extradited to US seven years after university supercomputer hack

The US Attorney’s office of the Western District of New York has confirmed that Ryan James Roach, a 35-year-old man from Saskatchewan, Canada, has been handed over to US authorities to face charges that he broke into American university networks and turned their supercomputers into cryptocurrency miners.

Roach was handed over to American authorities on October 28, and the development closes one chapter of a prosecution that began with a sealed grand jury indictment as far back as April 2022.

Meanwhile, Roach’s alleged partner is still fighting to prevent their removal from Canada.

From a Saskatchewan courtroom to Rochester federal court

Roach, who has lived in both Saskatoon and Regina, appeared in federal court in Rochester, New York, on Tuesday, November 3.

His detention hearing did not proceed as Roach reportedly told the court that he was not ready and asked for a later date, which has not yet been set. He has entered a not guilty plea, according to the US Attorney’s Office.

A Saskatchewan Court of King’s Bench judge cleared the path for his transfer in May, finding that the US evidence met Canada’s legal bar for extradition.

Roach has been charged alongside Mathiew James Stubbings, who is 41 years old from Ontario, Canada. However, Stubbings has not been removed to the US, with the Attorney General’s office saying that extradition proceedings against him are still running in Canada.

What did the pair do?

Prosecutors said that Roach and Stubbings were indicted over actions they carried out together, which stretched from June 2016 to December 2019.

During that window, the pair hunted for universities that ran on supercomputers, studied weak points in their networks, and then forced their way in.

Once they were able to get inside, they then allegedly planted malware into the system. This enabled them to lift login credentials and redirect the machines’ computing power to mine crypto for themselves.

They rented virtual private servers under fake names in several countries, including the United States, to cover their tracks.

According to the Justice Department, institutions that fell victim to these attacks were spread across New York, Tennessee, North Carolina and Massachusetts. One of those institutions is based in the Western District of New York.

Over a year period, the defendants damaged at least 10 protected computers, with the losses running north of $5,000.

Each man is charged with conspiracy, obtaining information from a protected computer, and intentionally damaging a protected computer. The counts carry up to 10 years in prison and a $250,000 fine.

The Electroneum trail and a $337,000 cleanup

The court filings reportedly show that in one specific case, the defendants broke into at least one New York State educational institution in 2017. They took more than 1,900 sets of login credentials and ran the school’s supercomputer to mine a coin called Electroneum.

The breach reportedly cost the institution around $337,000 in damages. This also includes the cost of shutting systems down, running forensics and rebuilding compromised infrastructure.

Investigators from the FBI were able to connect the breach to Roach by working through IP addresses, server logs, email accounts and hosting records, the filings say.

The tactics that were allegedly employed by Roach and his partner occurred before the proliferation of advanced AI in hacking. Google warns that attackers are also taking the cue and moving from classic cryptojacking toward stealing access to AI models, a tactic that it calls LLMjacking.

So far, Roach’s next hearing date has not been scheduled, and he is still presumed innocent unless he gets convicted.