US charges two Canadians accused of hacking US universities

What it is

A US federal grand jury indicted Ryan James Roach (35) and Mathiew James Stubbings (41), both Canadian, over intrusions into university networks in New York, Tennessee, North Carolina and Massachusetts between June 2016 and December 2019. The victim institutions are not named. Each defendant faces up to 10 years in prison and a $250,000 fine.

The charges are conspiracy to obtain information from a protected computer and to cause damage to a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. Prosecutors say the defendants damaged at least 10 computers over one year, causing losses of at least $5,000.

How it works

According to the DOJ, the defendants ran virtual private servers in several countries, registered under fake names. The servers delivered malware and mining software to victim machines and stored stolen login credentials. The DOJ says the defendants picked institutions that had supercomputers and researched security vulnerabilities in their networks. They used several access methods, including a server and compromised computers from another victim to hide their identities. Inside a network, they did reconnaissance and expanded their access. In some cases they used compromised systems for vulnerability research after reaching supercomputers.

Caveats

Roach was extradited from Canada on 28 October and arraigned before a detention hearing on 3 November. Stubbings will be arraigned after extradition. These are allegations, not convictions.

The page gives no indicators of compromise, malware names, vulnerabilities or initial access methods, and no defensive guidance. The "sophisticated techniques and tools" the DOJ cites are not described. The page also does not say how the activity was detected or attributed.