Supercomputer Cryptomining: What the DOJ Alleges and How Universities Can Spot It

The US Attorney’s Office for the Western District of New York says Ryan James Roach, 35, of Saskatchewan, was extradited from Canada on 28 October 2026. An indictment charges him and Mathiew James Stubbings, 41, of Ontario, over a scheme the indictment says ran from June 2016 to December 2019. Both are accused, not convicted, and the Department of Justice (DOJ) describes the claims as allegations.

The alleged aim was supercomputer cryptomining: using other people’s research machines to mine cryptocurrency in secret. This post explains the technique, why research clusters attract it and what a university can watch for.

What Does the Justice Department Allege?

The release names Assistant US Attorney Meghan K. McGuire as prosecutor and says Roach appeared before Magistrate Judge Mark W. Pedersen.

The alleged period ended nearly seven years before the extradition. Our reading is that this gap is a lesson for operators. An intrusion that goes quiet can still reach a courtroom, and the evidence then depends on logs that survived.

The release gives the alleged method. It says the two used virtual private servers in several countries, registered under false names. Those servers sent malware and mining software to victim computers and stored stolen login credentials.

The release says they researched weaknesses in the victim networks and hid behind a server and compromised computers from another victim. It says they deployed malware to take control, sent stolen data to servers they controlled and forced the victim computers to mine for them. Inside a network, it says, they ran reconnaissance and widened their access.

The release alleges damage to 10 or more protected computers in one year, with a loss of at least $5,000. Some of the damaged computers were at an institution of higher learning in the Western District of New York. This post rests on the DOJ release, not on the indictment itself.

What Is Resource Hijacking, and Why Target a Supercomputer?

MITRE ATT&CK calls this Resource Hijacking (T1496). Adversaries use the resources of systems they have taken over to run heavy tasks, and the sub-technique Compute Hijacking (T1496.001) covers using the processing power, for example for cryptomining. MITRE notes that preventive controls are hard to apply because the technique abuses legitimate system features.

A research cluster is a good fit, in our description of a typical one. It holds many cores or GPUs, serves many remote users and expects long, heavy jobs, so a miner looks like another simulation. The owner pays for power and lost capacity while the attacker collects the coins.

How Does a Stolen Login Turn Into Mining?

The DOJ says the scheme involved stealing login credentials. The chain below is our general description of how such an intrusion usually runs on a research cluster. It is not part of the DOJ’s allegations.

The weak point is the top layer. Once an attacker holds a valid account, every layer below sees an authorised user. That is why our page on valid accounts matters here, and why credential theft is the first thing to prevent.

Our ATT&CK mapping of the alleged chain is Valid Accounts (T1078) for the stolen logins and Compute Hijacking (T1496.001) for the mining. The release describes malware, reconnaissance and wider access in general terms and names no technique, so we map none of them.

The impact is cost and availability, not stolen files. MITRE lists degraded availability of the system as the effect of resource hijacking. For a shared cluster that means queue time lost to researchers, which is hard to measure and easy to miss.

What Should a Research Computing Team Watch For?

MITRE’s detection guidance points to persistent high CPU use alongside suspicious command-line activity, and to outbound connections to mining pools. Those signals suit a single server. On a cluster, we would add checks that follow the accounts and the scheduler.

1. Compare scheduler accounting with allocations. Flag accounts that burn compute hours while their owner is inactive or abroad.
2. Alert on sign-ins from new countries or networks, and on new SSH keys added to an account.
3. Watch login nodes for long-running processes outside the scheduler, and for jobs that never read or write research data.
4. Monitor campus egress for connections to known mining pool endpoints from cluster addresses.
5. Require MFA on the gateway where the system allows it, and expire unused accounts at the end of a project.
6. Rotate credentials when a leak is reported. Our guide on responding to leaked credentials lists the steps.

Keep authentication and scheduler logs for years, not weeks. Cases like this one are built from records of who logged in, from where, and what ran under their name. A cluster that rotates those logs after a month cannot answer questions about a 2016 login in 2026.

The checks in this list are our advice. Only the MITRE detection themes in the paragraph above them come from the cited source. Universities face this exposure as a sector; see our education industry page for the wider picture.

What Is Still Open?

The court outcome is open for Roach, and the extradition of Stubbings is still pending in Canada. The release says malware took control and credentials were stolen. It does not name the malware, the mining software or the flaws used, so we do not describe them. We will add facts here if the DOJ or the court record publishes them.