Mentioned in This Article
1. Who was extradited in the university cryptojacking case?
A Canadian man, Ryan James Roach, 35, of Saskatchewan, was extradited from Canada to the United States on October 28 to face charges over a scheme to hack university computers, steal login credentials and secretly mine cryptocurrency, the U.S. Justice Department said this week. He was arraigned in Rochester, New York, and is being held pending a detention hearing. Cryptojacking of this kind was allegedly carried out from 2016 to 2019.
A federal grand jury in the Western District of New York indicted Roach and a co-defendant, Mathiew James Stubbings, 41, of Ontario. Extradition proceedings against Stubbings are still under way in Canada.
2. What are the charges and the possible penalty?
The indictment lists three counts: conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The maximum penalty is 10 years in prison and a fine of $250,000.
A protected computer, in U.S. law, is broadly any machine connected to the internet and used in interstate or foreign commerce or communication, which covers the systems of most universities. A maximum sentence describes the upper limit for the charges and is not a prediction of what a court would impose if there were a conviction. The two men are accused, and the charges remain allegations until proven in court.
3. How did the alleged scheme work?
According to prosecutors, the pair targeted U.S. educational institutions between June 2016 and December 2019. They first researched weaknesses in the networks of their targets and then broke in. Once inside, they allegedly deployed malware, stole login credentials and forced the victims' computers to mine cryptocurrency for their own benefit.
To hide who they were, the pair allegedly used virtual private servers in several countries, registered under false names, to send malware and mining software and to store the stolen credentials. They also routed attacks through computers they had already compromised at other victims, which made the traffic appear to come from those machines and complicated the work of tracing it.
Victims were located in New York, Tennessee, North Carolina and Massachusetts, and one was a university in the Western District of New York. The Justice Department did not say which cryptocurrency was mined, and the available information does not describe any loss to victims beyond the cost of electricity and degraded performance.
4. What is cryptojacking and who pays for it?
Cryptojacking is the unauthorized use of someone else's computing power to mine cryptocurrency. Mining involves solving computational puzzles, which uses a great deal of processing capacity and electricity, so an operator who can run the work on machines belonging to others avoids almost all the cost of doing it legitimately.
The victims carry that cost. They pay the power bills that result from the extra workload, and they see slower performance as the hijacked machines devote capacity to mining. For a university, whose networks often serve research, teaching and administration at once, such an intrusion can disrupt important work, and the stolen credentials can give an intruder a foothold for further activity.
Monero is a common choice for this kind of scheme because it can be mined on ordinary hardware. In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple's macOS Screen Sharing feature to install Monero miners on Macs. In the university case, the Justice Department has not said which coin was involved.
5. Why are hackers shifting from cryptojacking to LLMjacking?
A report published on Monday by the Google Threat Intelligence Group expects attackers to focus more on LLMjacking, which it says they will increasingly prioritize over traditional resource theft such as cryptojacking. LLMjacking means hijacking a company's access to artificial intelligence models and leaving the company with the bill.
Google says the difference lies in how fast the money moves. Cryptojacking drains resources slowly, while LLMjacking can generate large cloud charges within hours. Its Mandiant unit investigated incidents this year in which fraudulent charges exceeded $100,000 in a single day, and some organizations incurred $1 million before access was cut off.
The report also says attackers resell stolen access through underground services that Google calls LLM Mixers. For defenders, the change means that credentials, which were valuable to cryptojackers, are now even more attractive, since a single stolen key to an AI service can be turned into costs or resale revenue almost immediately.
6. Why does the case matter for universities and security teams?
The allegations describe an intrusion that lasted more than three years, which illustrates how long unauthorized mining can go unnoticed on large institutional networks. Universities run many systems with varied owners and uneven oversight, and a hijacked machine may show only a modest slowdown that is easy to ignore.
The use of stolen logins also highlights a familiar point of defense. Strong authentication, monitoring for unusual processor load, and tight control over who can reach powerful computing resources reduce both the chance of a break-in and the time an intruder can stay hidden. The same practices apply to the newer threat of stolen access to AI services.
The extradition also shows how cross-border cooperation works in cybercrime cases. The Justice Department announced the case with the FBI's Buffalo field office and its own international affairs office, and the proceedings against the second defendant show that the process can take time.
7. What happens next in the case?
Roach is being held pending a detention hearing in Rochester, where a judge will decide whether he remains in custody while the case proceeds. No date for the hearing was given in the announcement.
Stubbings' extradition proceedings continue in Canada, and the outcome there will determine whether he too faces the charges in the Western District of New York. Until both men appear in court and the cases advance, the details of the allegations are those put forward by prosecutors. The next developments to watch are the detention hearing and any ruling on Stubbings' extradition.
8. Why do attackers use virtual private servers and compromised machines?
A virtual private server is a rented slice of a remote computer that behaves like a standalone machine. Renting one is inexpensive and can be done in many countries, so criminals use them as staging posts to send malware, host mining software and keep stolen data, rather than operating from their own addresses.
Registering the servers under false names adds a second layer of concealment, because the account records lead to no real person. Prosecutors say the pair used servers in several countries in this way, which spread the evidence across jurisdictions and made investigation harder.
Routing attacks through machines already compromised at other victims adds a third layer. An investigator who follows a connection back from the target arrives at an unrelated organization that is itself a victim, and must then trace the link one step further. Each hop slows the process and demands cooperation from more parties.
9. What is Monero and why is it popular with mining malware?
Monero (XMR) is a privacy-focused cryptocurrency. Its design hides sender, recipient and amount on the blockchain, which appeals to people who do not want their transactions to be traced. It is also built so that ordinary processors can take part in mining without specialized equipment.
That second feature is what matters to cryptojackers. Malware that runs on everyday computers, servers and laptops can produce coins on them, whereas other major coins require dedicated machines that a hijacked office computer cannot match. The Justice Department did not say which coin was mined in the university case, so the link to Monero here is a matter of common practice and is not an allegation.
The August warning from the Dutch national cyber agency shows the pattern in current use: attackers sought out a flaw in a widely deployed feature and used it to place miners on Macs, trading on the fact that many users never notice the extra load.
10. How can organizations spot unauthorized mining?
The most common sign is unexplained processor use. A machine that runs hot, runs its fans constantly or slows down when it should be idle is a candidate for inspection. At institutional scale, a spike in electricity or cloud costs without a matching increase in legitimate work is another prompt to investigate.
Security teams also watch for unfamiliar software, unusual outbound connections to mining pools and logins from unexpected places or at odd hours. Because the case involved stolen credentials, resetting passwords, enforcing multi-factor authentication and limiting privileged access are central to recovery and prevention.
The same controls help against LLMjacking. Unusual spending on AI services, keys that appear in code repositories and access from unfamiliar locations are warning signs, and rapid revocation of exposed keys limits how large a bill can become before it is noticed.
Extradition is the legal process by which one country hands a person to another to face charges. In this case, the Justice Department said Roach was extradited from Canada on October 28, after which he was brought before a court in Rochester, New York, for arraignment, the first formal step in which charges are read and a plea is entered.
The process in the second defendant's case is still running in Canada. Extradition proceedings typically involve hearings on whether the request meets the legal requirements, and they can take months or longer, which is why the two men, indicted together, are at different stages.
Cooperation of this kind depends on treaties between the countries and on the courts of the country where the suspect is located, which must be satisfied that the accusations, if proven, would be crimes under their own law as well. The Justice Department thanked no specific agency beyond the FBI and its international affairs office in the announcement shared online, and it gave no further detail on the extradition itself.