A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency.

A Canadian man, Ryan James Roach (35), has been extradicted to the United States to face charges tied to a hacking operation that targeted universities and other schools. Roach was extradited on October 28 and now faces federal charges alongside Mathiew James Stubbings, 41, of Ontario.

The indictment alleges that, from June 2016 to December 2019, the two men hacked computers, stole login details, and used victims’ machines to mine cryptocurrency for themselves.

“They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials.” DoJ states. “Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts. Some of the computers damaged by the defendants were located at an institution of higher learning in the Western District of New York.”

The targets were not random home PCs. Prosecutors say the pair went after U.S. schools with supercomputers, including institutions in New York, Tennessee, North Carolina and Massachusetts. Some affected computers belonged to a higher-education institution in western New York.

“To carry out the scheme, Roach and Stubbings surreptitiously accessed victim computers without authorization, deployed malware to gain control, stole victim login credentials, exfiltrated the data to servers that they controlled, and forcing victim computers to use their processing power to mine cryptocurrency for the financial benefit of the defendants.” DoJ continues.

That is a lot of effort to turn someone else’s research hardware into a personal crypto rig.

The alleged method was also more involved than a single phishing email. The indictment says they looked for weaknesses in victims’ networks, used servers and compromised machines from one victim to hide their tracks, and then moved through the network once inside. The duo used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network.

The charges include conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentional damage to a protected computer. Each carries up to 10 years in prison and a $250,000 fine. Prosecutors also allege the pair damaged at least 10 protected computers in one year and caused at least $5,000 in losses.

Roach appeared before U.S. Magistrate Judge Mark W. Pedersen and is being held pending a detention hearing. Extradition proceedings for Stubbings continue in Canada. The FBI, the Justice Department’s Computer Crime and Intellectual Property Section, and the Office of International Affairs worked on the case.

For security teams, the useful part is not the alleged crypto-mining. It is the reminder that universities remain attractive targets because they hold powerful computing resources, broad networks, and plenty of people with access. Patch quickly, watch for unusual processing load, and treat credential theft as a serious incident rather than a nuisance.

“The fact that a defendant has been charged with a crime is merely an accusation and the defendant is presumed innocent until and unless proven guilty.” DoJ concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, University Supercomputers)

Iranian hacker Amir Barati faces extradition to the US over an alleged Iranian campaign that stole 31TB of data from universities.

Amir Barati spent June 25 getting arrested in Montenegro, and this week a Montenegrin court signed off on sending him to the United States. He’s a dual Turkish and Iranian citizen, 40 years old, picked up by Montenegro’s Police Directorate after the FBI issued a warrant.

“He is accused of committing the following crimes: conspiracy to commit computer fraud and computer hacking, as well as identity theft, by conducting massive hacking attacks on the infrastructure of the United States of America since 2013, as an associate of a legal entity from the territory of Iran – at over 150 universities in the United States of America, causing damage estimated at more than 3.4 billion US dollars.” reads the press release published by Montenegro’s Police.

Barati’s hacking career reportedly began in Iran, where he founded the Iran Black Hats Team and later co-founded Digital Boys Underground Team. Archived records linked the groups to attacks on academic, commercial and government targets, including NASA, Microsoft and MIT. After his 2010 arrest by Iran’s Intelligence Ministry, sources said he was recruited as an intelligence asset, although this could not be independently confirmed. Iran International reports that Barati left Iran for Turkey in 2021, gained Turkish citizenship and changed his name. He was later arrested while on holiday in Montenegro. A US indictment subsequently linked him to the Mabna network and its alleged IRGC-backed campaign targeting universities.

Barati was arrested in Kotor, a coastal town in Montenegro, while he was on vacation.

In August, the US Justice Department named him in a 14-count indictment against 17 people. Prosecutors allege they were part of an operation run through the Iranian Mabna Institute on behalf of the Islamic Revolutionary Guard Corps.

The scale of the campaign was significant. Prosecutors say the group hacked email accounts at universities and research institutions around the world and stole at least 31 terabytes of data. US officials estimate the damage at $3.4 billion.

The targets weren’t random, either. Academic journals, theses, dissertations, electronic books, pulled from 144 American universities and 42 US companies, plus 178 foreign universities and at least 11 foreign companies. Between 2013 and 2017, the campaign allegedly compromised roughly 8,000 professor email accounts, using stolen credentials to get in and stay in.

Prosecutors describe Barati as directly involved in the operation, not just someone working in the background. The Record Media quoted the government saying he helped track the progress of the spearphishing campaigns. He also allegedly shared stolen credentials with other members, built lists of targets, carried out network reconnaissance, and wrote phishing emails himself.

According to the DOJ, the stolen data was sent to the Iranian government and also sold through two websites to universities in Iran. One of those sites allowed users to log in to US university library systems using stolen credentials belonging to professors. The affected universities also spent about $20 million investigating the attacks and repairing the damage.

Iran International’s reporting shows that Barati’s hacking activities go back years before the current indictment. He reportedly became known in Iran’s hacking scene and founded groups including the Iran Black Hats Team and the Digital Boys Underground Team. Both groups have been accused of targeting organizations such as Microsoft and MIT.

Iran International also confirmed that Montenegro plans to extradite Barati to the United States.

“Montenegro will extradite Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over a sweeping cyber campaign that US prosecutors say stole research and data for Iran’s Revolutionary Guards and other entities.” state Iran International.

Barati now faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft. Full reporting and the extradition order:

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iranian hacker)