Actor Profile

Two Canadian nationals, Ryan James Roach (35) and Mathiew James Stubbings (41), operated a financially-motivated cryptojacking campaign targeting US higher education institutions from June 2016 to December 2019. The actors leveraged virtual private servers registered under fake identities across multiple countries to obscure their operations. Their motivation was financial gain through unauthorized cryptocurrency mining using compromised supercomputing resources at educational institutions. Both defendants were indicted by a federal grand jury and face extradition from Canada, with Roach already arraigned in the United States as of November 3, 2026.

TTPs (Tactics, Techniques, Procedures)

The actors employed multi-stage intrusion techniques including: Initial Access via exploitation of unspecified vulnerabilities in university networks; Credential Access through theft of login credentials stored on compromised systems; Defense Evasion using VPN infrastructure registered under false identities and pivoting through previously compromised victim systems to mask attribution; Discovery and reconnaissance using sophisticated tools to map victim networks and identify supercomputing resources; Resource Hijacking (T1496) through deployment of cryptocurrency mining software on compromised systems; and Collection of sensitive data from victim networks. The operation demonstrated advanced OPSEC through multi-country C2 infrastructure and victim-to-victim pivoting for identity concealment.

Targets & Patterns

The actors specifically targeted educational institutions in the United States with supercomputing capabilities, focusing on universities in New York, Tennessee, North Carolina, and Massachusetts. The target selection was deliberate and resource-driven: higher education institutions provided access to high-performance computing infrastructure ideal for cryptocurrency mining operations while often maintaining less mature security postures than commercial enterprises. The actors also conducted vulnerability research on compromised supercomputers, suggesting secondary objectives beyond immediate financial gain. Educational institutions represent attractive targets for cryptojacking due to their computational resources, distributed network architectures, and historically limited security monitoring of research systems.

Historical Context

This indictment represents a multi-year cryptojacking campaign spanning 2016-2019, predating the wave of high-profile university breaches disclosed in November 2025 affecting Ivy League institutions including Harvard, Princeton, and the University of Pennsylvania. The timeframe coincides with the cryptocurrency boom period when mining profitability incentivized widespread abuse of compromised computing resources. The case demonstrates law enforcement's continued focus on prosecuting historical cybercrime operations, with Roach's extradition occurring in October 2026—nearly seven years after the alleged activity ceased. The defendants' use of supercomputers for vulnerability research suggests potential overlap with broader cybercriminal reconnaissance activities during this period.

Defensive Recommendations

  • Monitor for anomalous CPU/GPU utilization patterns indicative of cryptomining activity (T1496), particularly on high-performance computing systems and research infrastructure
  • Implement network segmentation to isolate supercomputing and research systems from general campus networks, with strict access controls and logging at boundary points
  • Deploy behavioral analytics to detect lateral movement and reconnaissance activity (T1046, T1018) following initial compromise, especially pivoting from one victim system to attack others
  • Enforce multi-factor authentication for all privileged accounts accessing research computing resources and monitor for credential theft indicators such as unusual authentication patterns or credential reuse
  • Establish baseline monitoring for outbound connections to known VPN providers and anonymization services, investigating sustained connections from research systems to foreign infrastructure

---

# Geopolitical Context

Geopolitical Context

This case represents a financially motivated cybercrime operation rather than state-sponsored activity, involving two Canadian nationals who allegedly conducted a multi-year cryptojacking campaign against US educational institutions between 2016 and 2019. The targeting of university supercomputers reflects the resource-intensive nature of cryptocurrency mining and the vulnerability of academic networks, which often prioritize openness and collaboration over stringent security controls. The successful extradition of one defendant and pending extradition of the second demonstrates functional US-Canada law enforcement cooperation on cybercrime matters, consistent with longstanding bilateral arrangements under the Mutual Legal Assistance Treaty framework. The operation's use of virtual private servers across multiple jurisdictions and false identities illustrates common obfuscation techniques employed by financially motivated threat actors to complicate attribution and evade detection.

State Actor Alignment

No state actor involvement is indicated in this case. The defendants appear to have operated as independent cybercriminals motivated by financial gain through cryptocurrency mining. The charges reflect violations of US federal computer fraud statutes rather than espionage or national security offenses. The bilateral extradition process between Canada and the United States proceeded through established judicial channels, indicating both governments treat this as a criminal matter rather than one involving geopolitical tensions or diplomatic complications. The case underscores the distinction between state-sponsored cyber operations and financially motivated cybercrime, even when critical research infrastructure is compromised.

Business Impacty pro region

The incident highlights persistent vulnerabilities within North American higher education networks, which house valuable research assets and high-performance computing resources attractive to both cybercriminals and state actors. The targeting of supercomputers at unnamed institutions in New York, Tennessee, North Carolina, and Massachusetts suggests the defendants identified facilities with significant computational capacity that could be exploited for resource-intensive mining operations. While this case involves financial crime, the compromise of university research infrastructure raises broader concerns about the security posture of academic institutions that may also house sensitive federally funded research, dual-use technologies, and international collaborations. The successful prosecution may serve as a deterrent to similar cryptojacking operations, though the relatively modest maximum penalties (10 years imprisonment and $250,000 fines) may not fully reflect the operational disruption and financial losses sustained by victim institutions.

Forecast

If the prosecutions result in convictions and substantial sentences, they may contribute to modest deterrence of cryptojacking operations targeting academic institutions, particularly among actors operating from jurisdictions with functional extradition treaties with the United States. However, the underlying vulnerabilities in higher education networks are likely to persist absent significant investment in cybersecurity infrastructure and personnel. As cryptocurrency values fluctuate, the economic incentive for such operations may diminish or intensify accordingly. The case is unlikely to have broader geopolitical ramifications given the absence of state involvement, though it may reinforce US-Canada cooperation frameworks on cybercrime. Educational institutions may face increased pressure from federal funding agencies to implement more robust security controls for high-performance computing resources, particularly those supporting sensitive research programs.