US Indicts Two Canadians for Hacking Multiple Universities and Crypto Mining

A federal grand jury in the United States has formally charged two Canadian citizens with a series of cyber intrusions that targeted multiple university campuses across the country. The indictment alleges that the duo gained unauthorized access to university computer systems, installed illicit cryptocurrency mining software, and siphoned significant computing resources for personal profit.

Details of the Federal Indictment

The indictment, filed by the U.S. Department of Justice, outlines a coordinated effort that began in early 2022. According to the complaint, the accused used stolen credentials and known vulnerabilities to infiltrate network segments that support research computing clusters. Once inside, they deployed mining scripts that ran continuously, consuming electricity and processing power without the knowledge of university IT staff.

Charges and Potential Penalties

Both individuals face charges that include unauthorized access to a protected computer, wire fraud, and conspiracy to commit computer fraud. If convicted, each could face up to ten years in federal prison for each count, along with substantial fines and restitution to the affected institutions.

How the Hackers Gained Access

Investigators say the perpetrators leveraged a combination of phishing emails and exploitation of unpatched software. In several cases, they sent targeted emails to faculty members, prompting them to click malicious links that installed credential-stealing tools. The stolen credentials were then used to log into privileged accounts that manage high‑performance computing clusters.

Common Attack Vectors

• Phishing campaigns aimed at faculty and staff.
• Exploitation of known vulnerabilities in outdated operating systems.
• Use of legitimate remote‑access tools to evade detection.

Impact on Affected Universities

While the indictment does not list every institution, public statements from at least three universities confirm that their networks were compromised. The unauthorized mining activity caused noticeable slowdowns in research workloads, increased electricity costs, and required extensive forensic investigations to remove the malicious code.

University Responses

University IT departments have taken several steps to remediate the damage:

1. Isolating affected servers and shutting down mining processes.
2. Conducting comprehensive password resets for all privileged accounts.
3. Applying security patches and updating intrusion detection rules.
4. Providing mandatory cybersecurity training for faculty and staff.

One university spokesperson emphasized that “the incident underscores the need for continuous monitoring and rapid response capabilities in academic environments.”

Legal and Policy Implications

The case highlights a growing trend of cybercriminals targeting educational institutions for their high‑performance computing resources. Law enforcement agencies are increasingly focusing on cross‑border cybercrime, and this indictment demonstrates the willingness of U.S. authorities to pursue foreign actors who threaten critical research infrastructure.

International Cooperation

U.S. officials have indicated that they are working with Canadian law enforcement to locate and apprehend the suspects. The collaboration reflects a broader effort to address cyber threats that transcend national borders.

Preventive Measures for Academic Institutions

Experts recommend a layered security approach to protect university networks from similar attacks. Key strategies include:

• Implementing multi‑factor authentication for all privileged accounts.
• Regularly updating software and applying security patches.
• Deploying network segmentation to isolate research clusters from general campus traffic.
• Conducting routine penetration testing and vulnerability assessments.
• Educating faculty and students about phishing tactics and safe email practices.

Cybersecurity firms such as the Cybersecurity and Infrastructure Security Agency provide guidance specifically tailored to higher‑education environments.

Broader Context of Crypto‑Mining Malware

Cryptocurrency mining malware has surged in popularity among cybercriminals because it can generate revenue without requiring direct financial transactions. According to a recent report by Symantec, crypto‑mining attacks increased by more than 300 percent in the past two years, with academic institutions emerging as attractive targets due to their powerful computing resources.

Why Universities Are Attractive Targets

University data centers often host clusters with dozens of high‑end CPUs and GPUs, designed for scientific simulations and machine‑learning research. These resources are ideal for mining operations that demand intensive processing power. Additionally, budget constraints can lead to delayed security updates, creating exploitable gaps.

What Comes Next?

The indictment marks a significant step in holding foreign cyber actors accountable for attacks on U.S. critical infrastructure. As the legal process unfolds, universities are expected to strengthen their cyber defenses and collaborate more closely with federal agencies.

Stakeholders across the academic and cybersecurity communities will be watching the outcome of this case closely, as it may set precedents for future cross‑border cybercrime prosecutions.