加拿大男子因黑客攻击大学超级计算机被引渡至美国
Canadian Man Extradited to US Over Plot to Hijack University Supercomputers for Crypto
加拿大男子Ryan James Roach和Mathiew James Stubbings因黑客攻击美国四州的教育机构超级计算机而被引渡至美国，他们被指控在2016年至2019年期间窃取登录凭证并秘密挖掘加密货币。谷歌警告称，黑客正在从加密货币挖矿转向LLMjacking，即劫持公司对AI模型的访问。
In brief
- A Canadian man has been extradited to the U.S. on charges of hacking university computers to steal login credentials and secretly mine cryptocurrency.
- Prosecutors say Ryan James Roach and Mathiew James Stubbings targeted educational institutions with supercomputers in four states between 2016 and 2019.
- The case comes as Google warns that hackers are moving from cryptojacking to hijacking access to AI models, a practice known as LLMjacking.
A Canadian man has been extradited to the United States to face charges that he helped hack into university computers to steal login credentials and secretly mine cryptocurrency, the Justice Department said on Tuesday.
A federal grand jury in the Western District of New York indicted Ryan James Roach, 35, of Saskatchewan, and Mathiew James Stubbings, 41, of Ontario, on charges of conspiracy to obtain information from and damage a protected computer, obtaining information from a protected computer, and intentionally damaging a protected computer. The charges carry a maximum sentence of 10 years in prison and a $250,000 fine.
Between June 2016 and December 2019, the pair targeted U.S. educational institutions with supercomputers, researching security weaknesses in their networks before breaking in, according to the indictment. Once inside, they allegedly deployed malware, stole login credentials and forced the victims' computers to mine cryptocurrency for their own benefit.
Victims included institutions in New York, Tennessee, North Carolina and Massachusetts, among them a university in the Western District of New York, prosecutors said. The pair allegedly used virtual private servers in several countries, registered under false names, to send malware and mining software to victim computers and store stolen credentials, and routed attacks through computers compromised at other victims to hide their identities.
Roach was extradited from Canada on October 28 and arraigned in Rochester, New York, where he was held pending a detention hearing. Extradition proceedings against Stubbings are continuing in Canada.
NEW$0.00 volume
Closes: Dec 1, 2026, 04:59 UTC
Closes: Dec 1, 2026, 04:59 UTC
From cryptojacking to LLMjacking
The scheme is a form of cryptojacking, in which attackers use other people's computers to mine crypto while the victims bear the electricity costs and slower performance. The Justice Department did not say which cryptocurrency the pair allegedly mined.
Privacy coin Monero has long been a favorite for such schemes because it can be mined on ordinary hardware. In August, the Dutch national cyber agency warned that attackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.
But hackers looking to profit from stolen computing power may be turning elsewhere. In a report published Monday, Google's Threat Intelligence Group said it expects attackers to "increasingly prioritize LLMJacking over traditional resource theft like cryptojacking," hijacking companies' access to AI models and passing on the bills.
Unlike the gradual drain of cryptojacking, LLMjacking can run up huge cloud charges within hours, Google said. In incidents investigated by its Mandiant unit this year, fraudulent charges topped $100,000 in a single day, and some organizations racked up $1 million before access was cut off. Attackers are reselling stolen access through underground services that Google calls "LLM Mixers."
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
Create an account to save your articles.
Add Decrypt as your preferred source to see more of our stories on Google.
来源：Decrypt · decrypt.co