Two Canadian men broke into the networks of multiple U.S. universities, stole credentials and implanted malware on compromised computers to commandeer processing power for a cryptocurrency mining operation, the Justice Department said.
Ryan James Roach and Mathiew James Stubbings allegedly compromised the networks of at least four universities in New York, Tennessee, North Carolina and Massachusetts between mid 2016 and late 2019, according to an unsealed indictment.
Roach, a 35-year-old from Saskatchewan, Canada, was extradited to the United States on Oct. 28 and arraigned Tuesday in the U.S. District Court for the Western District of New York. Prosecutors said they are still seeking the extradition of Stubbings, a 41-year-old from Ontario, Canada.
A grand jury previously indicted the Canadian nationals in April 2022. The men are charged with multiple cybercrimes and face up to 10 years in prison and up to a $250,000 fine, if convicted.
Prosecutors accuse the men of researching and identifying potential victims with supercomputers containing vulnerabilities they could exploit. The men breached networks and deployed malware on compromised machines to take over systems, officials said.
Roach and Stubbings allegedly rented virtual private servers based in Europe and the United States under false identities to conceal traffic, deploy rootkits, steal credentials and data, and transmit cryptocurrency mining software to compromised computers.
“The defendants caused at least one supercomputer to mine cryptocurrency on their behalf, which caused much of the supercomputer’s processing speed and power to become unavailable to its legitimate owner,” prosecutors wrote in the indictment.
Officials didn’t say how much cryptocurrency the pair allegedly mined for financial gain as part of the conspiracy.
If convicted, Roach and Stubbings are also ordered to forfeit an assortment of networking and data storage devices, and any property or proceeds obtained through the alleged crime spree.
The post Officials extradite Canadian man to US for alleged cryptomining spree appeared first on CyberScoop.
The attackers used offensive agentic techniques to access the company’s systems and internal tools.
The post Chainalysis Discloses Data Breach Following AI-Driven Cyberattack appeared first on SecurityWeek.
The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto.
The post FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist appeared first on SecurityWeek.
Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.
The post $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor appeared first on SecurityWeek.
Prosecutors announced charges against six alleged scammers based out of Africa who targeted Americans with fake non-fungible token (NFT) investment scams by posing as women on dating websites, netting hundreds of victims.
According to an affidavit for the arrest of of the six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — the criminal group with connections to China and Malaysia opened a scam compound in Madagascar early last year.
“In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments,” the Justice Department said in a news release Tuesday. “Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge.”
The FBI identified approximately 74 cryptocurrency wallets associated with approximately 800 victims in the scheme, for an estimated loss of at least approximately $516,695, according to the affidavit and news release.
The U.S. District of Columbia’s Scam Center Task Force, the FBI’s field office in Honolulu and the U.S. Attorney’s Office for the District of Alaska made a trip to Madagascar in August to review electronic devices seized from scam compounds. Interviews with scam compound workers there revealed that Cambodian police activity and armed conflict between Thailand and Cambodia led to operations at a Cambodian scam compound being moved to Madagascar.
Phones for the alleged scheme leader, Wa, contained employment contracts and scripts for what scammers should say to victims, which said they would be committing “an emotional scam.” The devices that officials reviewed and the interviews also established further connections between the scammers and Southeast Asia and China.
After the initial interviews, though, Madagascar repatriated some suspects to China before the investigation was complete, according to the Justice Department.
“Today, [D.C.] U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar,” the release stated.
In the same release, DOJ said that the Scam Center Strike Force had crossed the $1 billion threshold in cryptocurrency recovered in its first year.
The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles appeared first on CyberScoop.
A 44-year-old Chinese national was extradited to the United States and arraigned in federal court for his alleged involvement in a sweeping investment scam network that tricked at least 174 U.S. residents out of nearly $37 million, the Justice Department said Friday.
Zheng Zhao was extradited from the Netherlands to the United States to face a conspiracy to commit money laundering charge that could keep him in prison for 20 years.
Prosecutors accuse Zhao and his co-conspirators of operating a global cryptocurrency investment scheme out of multiple countries, including scam centers in Cambodia.
The cybercrime ring allegedly reached out to U.S.-based victims proactively via social media, phone calls, text messages and online dating sites to establish a deceitful relationship and build trust. Eventually, Zhao and his co-conspirators promoted cryptocurrency investments to the victims and directed them to send funds through fake sites that resembled legitimate trading platforms.
Victims were told their investments were growing in value, yet they were already transferred from U.S. bank accounts controlled by the co-conspirators to an account at Deltec Bank in the Bahamas, officials said. The crew allegedly converted the victim funds to Tether before transferring the assets to a digital wallet controlled in Cambodia.
The stolen funds were ultimately distributed to leaders of scam networks throughout the region, officials said.
Eight of Zhao’s co-conspirators previously pleaded guilty participating in the investment scam conspiracy, including Shengsheng He and Jingliang Su, who were sentenced to 51 months and 46 months in prison, respectively.
Joseph Wong, a co-conspirator living in California, managed a network of money launderers in Los Angeles who registered shell companies, opened U.S. bank accounts and transferred stolen victim funds to international bank accounts.
“This case should serve as a warning to scammers in every corner of the world: there is nowhere to hide,” Todd Bratz, special agent in charge of the U.S. Secret Service Criminal Investigation Division, said in a statement. “Secret Service investigators and our law enforcement partners remain unwavering in their commitment to identify those who operate scam centers, disrupt their financial infrastructure and bring them to justice.”
The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.
A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.
The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.
The people orchestrating North Korea’s IT worker scheme are funneling money through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report Tuesday.
The security firm’s research shows that the scheme is moving beyond funding the country’s weapons program and into a bigger pool that supports many of the regime’s objectives. This includes manufacturing weapons and supplying them to Russia’s military, according to DTEX.
“When we think IT workers, we typically think head down, get your money, support the weapons program,” Michael Barnhart, nation state investigator at DTEX and lead author of the report, told CyberScoop.
“It’s a broad cover-all statement when we say it’s supplying the weapons program,” he said. “That’s the predominant place it goes,” but many other domestic programs and entities tasked with other projects are taking cuts from that pool of money as well.
Barnhart corroborated previously leaked data from an internal North Korean payment server, which included 390 IT worker accounts, chat logs and transaction data.
He mapped the transactions to organizations that received those funds, including multiple sanctioned entities: Sobaeksu, Saenal, and Songkwang.
The money trail also showed $1.97 million in payments from North Korean IT workers between December 2025 and February 2026 flowing directly through Korea Ryonbong General Corp, a sanctioned defense entity that procures weapons for the regime’s military programs.
Western officials previously reported that North Korea provided ammunition and weapons to Russia in 2023, and in the fall of 2024 sent upwards of 15,000 soldiers to fight alongside Russian troops, according to the Council on Foreign Relations.
“This is a consequence that is often overlooked,” Barnhart wrote in the report. “Revenue from the IT worker stream does not stop at a resume scam or a payroll-abuse story. It can feed a larger DPRK system that supports sanctioned entities, domestic state needs, and a Russia war effort that is actively consuming all facets of North Korean weapons and military support.”
Data from the internal North Korean payment server, which was first published by ZachXBT in April, is controlled by “PC-1234,” a single administrator that DTEX has been tracking for a while. The wallet and its cluster of activity remains active, Barnhart said.
The three months of previous activity attributed to the wallet amounted to more than $2.84 million, which then flowed upward into dozens of organizations.
“It’s not a top-down funded regime. It’s a bottom-up,” Barnhart said. “Everyone makes money at the bottom and then they take a tiny cut, and then the money goes upwards to what we just blanketly say is the weapons program. But really, it can go a lot more places.”
The post North Korea’s IT worker scheme funds Russia’s war effort appeared first on CyberScoop.
Beau Bullock// Overview This blog post is meant to serve as a basic introduction to the world of cryptocurrencies. With cryptocurrencies making their way into mainstream news outlets I am […]
The post Intro to Cryptocurrency and How to Secure Your Coins appeared first on Black Hills Information Security, Inc..
Login