A federal grand jury has formally indicted two Canadian men, **Ryan James Roach** (35) and **Mathiew James Stubbings** (41), on charges related to a sophisticated hacking operation against several U.S. universities. The duo now faces significant penalties, including up to 10 years in prison and a $250,000 fine each, if convicted of conspiracy and damage to protected computers. ### The Modus Operandi According to court documents, the alleged activities spanned from June 2016 to December 2019. **Roach** and **Stubbings** reportedly utilized virtual private servers registered under fictitious names in various countries to deploy malware across the networks of unnamed educational institutions in New York, Tennessee, North Carolina, and Massachusetts. The **Department of Justice (DOJ)** stated, "These servers transmitted malware and mining software to victim computers and stored stolen login credentials." ### Exploiting Academic Networks Once inside the university networks, the defendants allegedly engaged in a multi-faceted attack. This included: * **Data and Credential Theft**: Stealing sensitive information and user login details. * **Cryptocurrency Mining**: Deploying crypto-mining malware to leverage the institutions' computational resources for personal gain. * **Vulnerability Research**: In some cases, they reportedly used compromised systems, including access to supercomputers, to conduct their own security vulnerability research. "**Roach** and **Stubbings** targeted educational institutions in the United States that had supercomputers and researched security vulnerabilities in the victim computer networks, using a variety of methods to gain access, including using a server and compromised computers from another victim to conceal their identities," the **DOJ** added. "Once inside a network, **Roach** and **Stubbings** used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network." Prosecutors also claim the two damaged at least 10 computers over a year, resulting in losses exceeding $5,000. ### Extradition and Legal Proceedings **Roach** was extradited from Canada to the United States on October 28 and has since been arraigned. **Stubbings** awaits his own extradition from Canada before facing arraignment. This incident highlights a concerning trend of cyberattacks targeting academic institutions. In recent years, several prominent U.S. universities, including Ivy League schools like **Harvard University**, **Princeton University**, and the **University of Pennsylvania**, have disclosed data breaches. These breaches, often impacting donor information and other sensitive data, underscore the persistent threat faced by educational sectors from sophisticated cybercriminals.