Ryan James Roach, 35 of Saskatchewan, Canada, and Mathiew James Stubbings, 41, of Ontario, Canada, ended up charged with conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer. The maximum sentence is 10 years in prison and a $250,000 fine.
Between June 2016, and December 2019, Roach and Stubbings conspired to engage in a scheme to hack into computers, steal login credentials, and secretly mine cryptocurrency for financial gain, according to the indictment.
Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts. Some of the computers damaged by the defendants were at an university in Western New York. Roach and Stubbings damaged 10 or more protected computers during a one-year period, causing a loss of at least $5,000.
Gained Control of Computers
To carry out the scheme, Roach and Stubbings surreptitiously accessed victim computers without authorization, deployed malware to gain control, stole victim login credentials, exfiltrated the data to servers they controlled, and forcing victim computers to use their processing power to mine cryptocurrency for the financial benefit of the defendants, according to the indictment.
Roach and Stubbings targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities, according to the indictment.
Once inside a network, Roach and Stubbings used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network.
Roach ended up arraigned before U.S. Magistrate Judge Mark W. Pedersen in federal court and held pending a detention hearing. Extradition proceedings continue in Canada for Stubbings.