For more than three years, computers at several American universities were allegedly doing work their owners never asked for. According to a federal indictment, two Canadian men broke into campus networks, stole passwords and quietly used the machines to mine cryptocurrency for themselves. One of them is now in the United States to face charges in the university supercomputer hacking case. The other is still fighting extradition in Canada. U.S. Attorney Michael DiGiacomo announced that a federal grand jury has indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario. Both face charges of conspiracy to obtain information from and cause damage to a protected computer, obtaining information from a protected computer, and intentional damage to a protected computer. The charges carry a maximum penalty of 10 years in prison and a $250,000 fine.

Why the University Supercomputer Hacking Targeted Campuses

The indictment points to a clear reason for the choice of targets. Roach and Stubbings allegedly went after educational institutions in the United States that had supercomputers. The scheme relied on processing power. Once inside, the pair allegedly forced victim computers to run cryptocurrency mining software, putting the machines' computing power to work for their own financial gain. Machines built for heavy computation made the scheme more profitable. Victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Some of the damaged computers belonged to a higher education institution in the Western District of New York, where the case is being prosecuted.

How the Alleged Scheme Worked

According to the indictment, the scheme ran from June 2016 to December 2019 and followed a set pattern. The pair allegedly researched security weaknesses in victim networks before getting in. They accessed computers without authorization and deployed malware to take control. They then stole login credentials and sent the data to servers they controlled. Once inside a network, they allegedly used sophisticated techniques and tools to carry out reconnaissance and expand their access. The stolen login credentials were stored on their servers, the same servers that sent out malware and mining software to victim machines. The indictment says Roach and Stubbings damaged 10 or more protected computers within a one-year period, causing a loss of at least $5,000.

How They Allegedly Stayed Hidden

The case also shows the effort the pair allegedly put into avoiding detection. They used virtual private servers in multiple countries, registered under false names. Those servers delivered malware and mining software to victim computers and held the stolen credentials. To conceal their identities further, they allegedly used a server and compromised computers belonging to one victim to gain access to another. That meant intrusions could appear to come from a victim's own systems instead of from the people behind them.

Where the University Supercomputer Hacking Case Stands

Roach was extradited from Canada to the United States on October 28. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing on November 3. Extradition proceedings for Stubbings are continuing in Canada. The investigation was carried out by the Federal Bureau of Investigation, under the direction of Special Agent-in-Charge Allen D. Davis II, and the Department of Justice's Computer Crime and Intellectual Property Section. The Justice Department's Office of International Affairs helped secure Roach's arrest and extradition. Assistant U.S. Attorney Meghan K. McGuire is prosecuting the case.

What Is Still Unclear

The indictment leaves several details open. It does not say how much cryptocurrency the pair allegedly mined, how many institutions were affected in total, or which universities were targeted beyond their states. The loss figure stated in the charges, at least $5,000, is the legal threshold tied to the damage count, not a full estimate of the harm. An indictment is an accusation, not proof. Both men are presumed innocent unless and until proven guilty.

Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentication entirely. That makes the choice of an intelligence vendor in this space an operational decision, not a box-checking exercise. 

Top 10 Infostealer Intelligence Vendors 

1. Cyble

Cyble is a preferred vendor for organizations that want infostealer data inside a broader threat intelligence workflow rather than as a standalone feed. Its Cyble Vision platform combines compromised credential monitoring with dark web surveillance, brand protection, and attack surface management, so a leaked employee login can be connected to related exposure elsewhere.   The company's research arm, Cyble Research and Intelligence Labs, publishes regular analysis of new stealer families and campaigns. For teams that need context across several threat categories in a single console, Cyble is a strong starting point. Buyers focused narrowly on deep machine-level forensics should test that capability directly during a trial.

2. Flare

Flare is a full CTI platform that treats stealer logs as a core dataset rather than an add-on. Its interface is one of the cleanest in the category, which lowers the learning curve for analysts. Coverage of stealer logs is broad, and the platform provides solid details about infected machines.

3. SpyCloud

SpyCloud focuses on identity threat protection and is particularly strong on session data. It tracks stolen cookies and helps organizations invalidate compromised sessions before attackers can use them. That focus makes it a natural fit for teams worried about MFA bypass. Its free public tooling is more limited than some competitors'.

4. Breachsense

Breachsense takes an API-first approach to dark web and stealer-log monitoring. Its backend is consistent and well-documented, which appeals to teams that plan to pipe alerts directly into a SIEM or SOAR rather than work in a vendor's dashboard.

5. Lunar (Webz.io)

Lunar is built on Webz.io's web data infrastructure and stands out for generous free access to compromised-credential monitoring. Smaller organizations can get meaningful visibility without a large contract. Its API is less mature than those of the leaders, so heavy integration work may take more effort.

6. SOCRadar

SOCRadar positions itself as an extended threat intelligence provider, and its infostealer data sits alongside external attack surface monitoring and digital risk protection. Machine context is a notable strength. Teams looking for a specialist tool may find the platform's breadth more than they need.

7. Constella Intelligence

Constella approaches infostealers through the lens of identity risk, drawing on a large repository of breach and exposure records. Session tracking and API capabilities are both well regarded, which makes it useful for fraud prevention and account takeover defense.

8. Recorded Future

Recorded Future is one of the best-known names in threat intelligence. Infostealer data is one module among many in its intelligence platform. Machine context and API quality are strong, though session-level detail trails the more focused vendors. Organizations already using Recorded Future for other intelligence may find it convenient to extend coverage here.

9. NordStellar

NordStellar comes from Nord Security, the company behind NordVPN. It has gained ground quickly, with strong session coverage and good machine context. It is a relatively new entrant, so buyers should weigh its fast development pace against a shorter track record.

10. KELA

KELA specializes in cybercrime intelligence gathered from underground forums and marketplaces. Its infostealer coverage benefits from that vantage point, and session tracking is solid. Machine context and API depth are moderate compared with the vendors ranked above it. 

What Buyers Should Take Away 

No single vendor wins on every measure. Teams that want infostealer intelligence connected to wider threat monitoring will find Cyble, Flare, and SOCRadar worth a close look. Those focused on stopping account takeover should prioritize session capabilities, where SpyCloud, Constella, and NordStellar perform well. Engineering-heavy teams should put API quality near the top of their criteria, which favors Breachsense and Recorded Future.  Whatever the shortlist, two capabilities deserve extra weight. The first is session coverage, because cookie theft is now a routine way to defeat MFA. The second is machine context, because knowing exactly which device was compromised determines how quickly a team can contain the damage. A trial run against a known set of exposed accounts remains the most reliable way to see how a vendor performs in practice.  (Disclaimer: This article is based on third-party research and publicly available information, credited where applicable. The Cyber Express does not endorse any product or service mentioned. Readers are advised to verify information independently and consult qualified professionals before acting on it.)

The U.S. Justice Department and FBI have seized two hacking tools, Microscan and FishHub, that court documents say were operated and used by Flax Typhoon actors working for a China-based company. According to the government, the tools were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems and other networks. The court-authorized seizures were announced alongside court documents unsealed in the Western District of Pennsylvania. Prosecutors allege the actors worked for Integrity Technology Group (Integrity Tech), a company based in the People's Republic of China (PRC) that holds contracts with the PRC government. The action is the latest step by U.S. authorities against China state-sponsored hackers.

How Flax Typhoon Actors Used Microscan for Vulnerability Scanning

According to court documents, Integrity Tech built and used a botnet of internet-of-things devices infected with a variant of Mirai malware. The botnet supported the company's vulnerability scanning through Microscan, a tool Integrity Tech developed to perform reconnaissance on victim networks and identify weaknesses its clients would later exploit. Targets of Microscan scanning included a U.S. power company based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.

FishHub and the Flax Typhoon Spear Phishing Operation

The second tool, FishHub, allegedly helped compromise computer networks through spear phishing. After gaining initial access, FishHub downloaded additional malware to the victim network. That malware either gave Integrity Tech's clients unauthorized remote access or searched for specific files and sent them to servers controlled by Integrity Tech. Confirmed FishHub victims included about 20 Taiwanese universities. Five seized domains helped deliver the malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.

What Officials Said About Flax Typhoon

Assistant Attorney General for National Security John A. Eisenberg said the United States "will not allow China or its proxies to operate against United States interests with impunity in cyberspace." He added that the National Security Division would continue working to disrupt the Flax Typhoon threats and dismantle the infrastructure sustaining them. Assistant Director Brett Leatherman of the FBI's Cyber Division said, "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure." U.S. Attorney Troy Rivetti for the Western District of Pennsylvania described the seizures as the second disruption of Integrity Tech's operations in as many years. Special Agent in Charge Mark Remily of the FBI San Diego Field Office said the action reflects the FBI's commitment to disrupting PRC state-sponsored cyber actors who threaten critical infrastructure and national security.

Second Disruption of Flax Typhoon Infrastructure

This is the Justice Department's second public technical disruption of Integrity Tech's hacking infrastructure. In September 2024, the department announced the court-authorized disruption of Integrity Tech's Mirai botnet, which included more than 200,000 consumer devices in the United States and worldwide. Alongside the latest seizures, the FBI and other U.S. and foreign partner agencies published a cybersecurity advisory listing indicators of compromise tied to Integrity Tech intrusion activity. The advisory is intended to help network defenders identify and respond to the group's malicious activity. The FBI San Diego and Baltimore Field Offices are investigating the case in coordination with the FBI's Cyber Division. Assistant U.S. Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division's National Security Cyber Section are prosecuting the case. Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and the National Police Agency of Japan provided substantial assistance.

A North Korean cyber actor group known as WaterPlum, also referred to as "Contagious Interview," has infected at least 30,000 devices across more than 100 countries. The group has been stealing cryptocurrency from IT professionals worldwide. A joint advisory was issued on September 18, 2026, by Japan's National Police Agency and National Cybersecurity Office, the US FBI and Department of Defense Cyber Crime Center, Australia's Signals Directorate, and Germany's Federal Intelligence Service and Federal Office for the Protection of the Constitution.

How WaterPlum Hackers Operate

The agencies assess that WaterPlum actors and certain North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, part of the Workers' Party of Korea's Central Committee. The group poses as prospective employers, targeting software developers and IT professionals by impersonating artificial intelligence, cryptocurrency, or non-fungible token companies, and by using recruiting services. During fake technical interviews, victims are instructed to download files to complete coding assignments or fix errors on video calls. These files carry malicious Node Package Manager packages embedded with BeaverTail malware, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle. Once installed, the malware grants backdoor access, allowing Remote Access Trojans to maintain persistence while infostealers exfiltrate wallet credentials, browser passwords, clipboard data, keystrokes, and identification documents to command-and-control servers.

Scale of the Cryptocurrency Theft

Between December 2025 and July 2026, WaterPlum exfiltrated funds or credentials from over 7,000 cryptocurrency wallets, transferring 1.7 billion Japanese yen, equivalent to 10.71 million USD, to North Korea. Primary targets included web designers, engineers, and specialists in blockchain and Web3 technologies.

Role of Laptop Farms

The advisory also details how North Korean IT workers generate foreign currency through "laptop farms," locations, often an enabler's residence, where employment computers are remotely controlled by workers based in North Korea, China, Russia, and occasionally Africa or Southeast Asia. Enablers supply identification images, bank accounts, and internet connections, then forward payments to the workers after taking a cut. Japanese authorities dismantled a laptop farm for the first time domestically, uncovering evidence of several hundred million yen transferred abroad in cryptocurrency. A related case involved a suspected North Korean applicant at a Japanese cryptocurrency exchange in May 2025, who submitted a forged resume, accessed the recruitment portal via VPN, and displayed mismatched language skills during a video interview. The company declined to hire the applicant, and no damage occurred.

Warning Signs and Recommended Countermeasures

The agencies list red flags including refusal of in-person meetings, requests for cryptocurrency payment, background voices during calls, and repeated video freezes. Recommended defenses include avoiding execution of untrusted code outside a sandbox, treating VSCode projects with caution using "Restricted Mode," deploying Endpoint Detection and Response tools, and immediately disconnecting compromised devices from the internet. Victims are advised to assume wallet data has been exposed, create new wallets on separate devices, and perform full operating system resets.

International Cooperation Continues

The FBI stated it continues to prosecute US-based facilitators who assist North Korean IT workers, while Japanese and American authorities pledged ongoing cooperation to expose revenue-generation schemes benefiting the Kim regime. The advisory noted that WaterPlum and North Korean IT worker operations shared overlapping IP addresses across laptop farms, crowdsourcing platforms, and job applications, indicating coordinated infrastructure. Companies and individual IT professionals are urged to review the tactics outlined in the advisory and strengthen hiring verification processes to prevent further infiltration.