[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1VcL4lbMzePqQQOufQ3cvEdyzK3HEFik1HvPPSMtois":3},{"article":4,"iocs":48,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e7af5a38-2c6e-4621-a7f1-7855c29b0af4","Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers","canadian-extradited-to-us-over-cryptomining-hacks-on-university-supercomputers-165425","A federal grand jury indicted two Canadian men for hijacking university supercomputers to secretly mine Electroneum cryptocurrency. The post Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers appeared first on SecurityWeek.","Two Canadian men, Ryan James Roach and Mathiew James Stubbings, have been indicted in New York for allegedly orchestrating a multi-year campaign to hijack university supercomputers for cryptocurrency mining. The operation, spanning from 2016 to 2019, involved compromising systems at academic institutions across four US states and using fraudulent VPN infrastructure to manage the attacks. Roach has been extradited to the US, while Stubbings' extradition is pending.","Two Canadians extradited to US for hijacking university supercomputers to mine cryptocurrency.","https:\u002F\u002Fwww.securityweek.com\u002Fcanadian-extradited-to-us-over-cryptomining-hacks-on-university-supercomputers\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F01\u002Fcryptocurrency.jpeg","2026-11-04T12:27:58+00:00","2026-11-04T13:00:34.011392+00:00",7,[17,20,22],{"name":18,"type":19},"Ryan James Roach","threat_actor",{"name":21,"type":19},"Mathiew James Stubbings",{"name":23,"type":24},"Electroneum","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":25,"icon":27,"name":28,"slug":29},null,"Nation-state","nation-state",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[49],{"type":47,"value":23,"context":50},"Cryptocurrency mined on hijacked university supercomputers.",[23],{"controls":53,"vendors":140},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[59,66,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":61,"url":64,"description":65},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":112,"name":113,"problem":114,"products":115},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":153},"supercomputer-cryptojacking-highlights-academic-network-security-gaps","Supercomputer Cryptojacking Highlights Academic Network Security Gaps","Over three years, two Canadian nationals compromised university supercomputers across four US states to mine cryptocurrency, exploiting weak access controls and leveraging fraudulent VPN infrastructure to conceal their activity. The root cause lies in insufficient access control enforcement and failure to detect anomalous resource consumption on high-performance computing systems. Academic institutions often prioritize open access for research collaboration, inadvertently creating permissive environments that attackers can exploit. The prolonged duration of the campaign — three years — underscores a critical failure in monitoring and anomaly detection, since cryptomining generates distinctive, sustained CPU and GPU spikes that should trigger alerts. This incident matters because unauthorized use of research supercomputers disrupts legitimate academic work, wastes institutional resources, and demonstrates that even non-traditional targets hold significant value for cybercriminals.",[146,147,148,149,150,151,152],"CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1496: Resource Hijacking","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"MITRE ATT&CK T1496: Resource Hijacking":156,"CIS Control 6: Access Control Management":157,"CIS Control 13: Network Monitoring and Defense":158,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":159,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":160},"NIS2 requires incident handling and monitoring controls for essential services; universities operating critical research infrastructure should implement equivalent standards to detect and respond to multi-year intrusion campaigns of this type.","Attackers likely exploited known vulnerabilities to gain initial footholds; a disciplined patch and flaw remediation process would have reduced the attack surface available to the perpetrators.","This technique directly describes the adversaries' goal of hijacking computing resources for cryptomining, and defenders with detections mapped to this technique would have flagged the sustained anomalous resource consumption.","The attackers maintained persistent access over three years; enforcing strict, regularly reviewed access control policies with MFA would have prevented or dramatically shortened unauthorized entry into university systems.","Continuous network monitoring tuned to detect cryptomining traffic patterns and connections to mining pools would have identified the malicious activity far earlier in the campaign.","Without a formal program to identify and remediate technical vulnerabilities in internet-facing academic systems, the universities remained exposed to exploitation over the entire three-year campaign.","Fraudulent VPN infrastructure was used to manage attacks, indicating weak identity verification; strong authentication and identity governance controls would have blocked or exposed the unauthorized access."]