A Canadian man was extradited to the U.S. to face charges over hacking universities and hijacking their computers to mine cryptocurrency. A Canadian man, Ryan James Roach (35), has been extradicted to the United States to face charges tied to a hacking operation that targeted universities and other schools. Roach was extradited on October 28 and now faces federal charges alongside Mathiew James Stubbings, 41, of Ontario. The indictment alleges that, from June 2016 to December 2019, the two men hacked computers, stole login details, and used victims’ machines to mine cryptocurrency for themselves. “They used virtual private servers in multiple countries, which were registered under false names. These servers transmitted malware and mining software to victim computers and stored stolen login credentials.” DoJ states. “Victims of the scheme included educational institutions in New York, Tennessee, North Carolina, and Massachusetts. Some of the computers damaged by the defendants were located at an institution of higher learning in the Western District of New York.” The targets were not random home PCs. Prosecutors say the pair went after U.S. schools with supercomputers, including institutions in New York, Tennessee, North Carolina and Massachusetts. Some affected computers belonged to a higher-education institution in western New York. “To carry out the scheme, Roach and Stubbings surreptitiously accessed victim computers without authorization, deployed malware to gain control, stole victim login credentials, exfiltrated the data to servers that they controlled, and forcing victim computers to use their processing power to mine cryptocurrency for the financial benefit of the defendants.” DoJ continues. That is a lot of effort to turn someone else’s research hardware into a personal crypto rig. The alleged method was also more involved than a single phishing email. The indictment says they looked for weaknesses in victims’ networks, used servers and compromised machines from one victim to hide their tracks, and then moved through the network once inside. The duo used sophisticated techniques and tools to conduct reconnaissance and expand their access within the network. The charges include conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentional damage to a protected computer. Each carries up to 10 years in prison and a $250,000 fine. Prosecutors also allege the pair damaged at least 10 protected computers in one year and caused at least $5,000 in losses. Roach appeared before U.S. Magistrate Judge Mark W. Pedersen and is being held pending a detention hearing. Extradition proceedings for Stubbings continue in Canada. The FBI, the Justice Department’s Computer Crime and Intellectual Property Section, and the Office of International Affairs worked on the case. For security teams, the useful part is not the alleged crypto-mining. It is the reminder that universities remain attractive targets because they hold powerful computing resources, broad networks, and plenty of people with access. Patch quickly, watch for unusual processing load, and treat credential theft as a serious incident rather than a nuisance. “The fact that a defendant has been charged with a crime is merely an accusation and the defendant is presumed innocent until and unless proven guilty.” DoJ concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, University Supercomputers)
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a
A critical finding can move through several security tools and still leave the organization exposed. The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what protection exists, and how a change could affect the business. Each missing detail creates
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with
OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs. "Our prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE)
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. The new feature, announced by Vercel's CTO Malte Ubl on X, binds a login session to the user's device with a private key stored in a TPM, so even if the session cookie is stolen, it can't be reused on another device. Vercel is a cloud platform developers use to deploy and host websites, web applications, and AI agents. The company also develops the popular Next.js web framework. Its latest announcement concerns logins to Vercel's platform at vercel.com, where developers manage their projects and deployments. "DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie," explained Ubl.
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. The flaw affects ten GS1900 switch models, and Zyxel released security updates on October 22 and published a security advisory on November 3. However, the vulnerability was initially mistaken for an older flaw that Zyxel had already patched months before the attacks began. On June 16, 2026, Zyxel released security updates addressing CVE-2026-7273, a pre-authentication buffer overflow vulnerability affecting the same GS1900 switches.
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets. A cyberattack has hit three regional blood banks in France, disrupting systems used to monitor and control refrigerated storage facilities. The incident took place overnight between Sunday and Monday, at roughly the same time hackers were targeting supermarket refrigeration systems across several European countries. The attack is particularly concerning because it targeted infrastructure that plays a direct role in protecting public health. Blood products must remain within specific temperature ranges to preserve their quality and ensure they’re safe for medical use. A disruption to refrigeration systems can therefore have consequences that go well beyond a conventional IT outage. According to the French Health Ministry, the incident affected several facilities operated by the French Blood Establishment (EFS). “Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems,” the health ministry said in a statement. “The incident had no impact on blood supplies,” Reuters reported, quoting EFS spokesperson Charley Dubois. Staff working around the clock received alerts about the problems and moved blood products to refrigerators that weren’t connected to the affected systems. This response helped prevent the incident from disrupting blood supplies, demonstrating how important operational procedures and contingency plans are when technology fails. “The situation was under control on Wednesday,” the French Health Ministry said, according to Reuters, which also reported that remote access to the affected refrigerators had been disabled. Investigations are now underway to establish how the attackers gained access, which equipment was affected and when the systems can safely return to normal operation. The timing is also significant. The French blood bank incident coincided with attacks against supermarket refrigeration systems in eight European countries, including Sweden and Belgium. Those attacks forced retailers to discard large quantities of food after hackers interfered with cooling and freezer systems. This wasn’t the first time French supermarkets had faced csxk cx incident. In October, police investigated an attack in which hackers allegedly seized control of cooling units at hundreds of supermarkets, causing fires and significant food losses. These incidents share similarities that deserve attention. They point to a security problem beyond traditional corporate IT systems: the growing exposure of operational technology (OT), including industrial control systems, refrigeration equipment, and the remote management platforms kdch operate them. These systems are often connected to corporate networks or accessible through remote management services. If attackers compromise those access points, they may be able to interfere with physical processes rather than simply steal information or encrypt business data. The consequences can be serious. In a supermarket, an attacker who manipulates refrigeration controls can cause food losses and potentially create safety risks. In a blood bank, the same type of interference could threaten the integrity of medical supplies and disrupt services that hospitals depend on. The French incident didn’t affect blood supplies, but the outcome shouldn’t lead organizations to underestimate the risk. Staff intervention and the availability of independent refrigerators helped contain the damage. Not every facility will have the same resources, response procedures or ability to move critical products at short notice. Organizations operating critical infrastructure need to treat the security of connected equipment as a core operational requirement. This means identifying exposed systems, restricting remote access, enforcing strong authentication, segmenting operational networks and monitoring changes to equipment settings. They also need tested manual procedures that allow essential services to continue when digital systems become unavailable or untrustworthy. The European Union has already raised concerns about vulnerabilities in connected infrastructure amid heightened security tensions following Russia’s invasion of Ukraine in 2022. These latest incidents reinforce the need to consider cyberattacks against physical systems as a real operational and public safety risk, not simply an IT problem. “Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French Blood Banks)
Confirm this action.
Leaving now will discard your changes.