Ryan James Roach, 35, and Matthew James Stubbings, 41, are facing federal charges over an alleged malware campaign that targeted educational institutions in four U.S. states between June 2016 and December 2019. If convicted, the two men could receive up to 10 years in prison and a $250,000 fine for conspiracy to obtain information from and damage protected computers, obtaining information from a protected computer, and intentionally damaging a protected computer.
Malware campaign targeted educational networks
According to court documents, Roach and Stubbings used virtual private servers registered under false names in multiple countries to infect systems on the networks of unidentified educational institutions in New York, Tennessee, North Carolina, and Massachusetts.
“These servers sent malware and mining software to victims’ computers and stored stolen login credentials,” the Department of Justice (DOJ) said.
The Justice Department said the defendants deployed supercomputers and targeted U.S. educational institutions that were researching security vulnerabilities in their networks. They allegedly used multiple methods to gain access, including compromised servers and other victims’ computers to conceal their identities.
“Once inside the network, Roach and Stubbings used advanced techniques and tools to conduct reconnaissance and expand their access within the network,” the department added.
At least 10 computers allegedly damaged
Prosecutors say the two defendants damaged at least 10 computers over the course of a year, causing at least $5,000 in losses.
The charges allege activity spanning several years, but the specific educational institutions involved have not been identified in the source court documents.
Universities remain targets for cyberattacks
Multiple U.S. universities have reported breaches over the last year, including Ivy League institutions Harvard University, Princeton University, and the University of Pennsylvania. The data breaches disclosed in November 2025 each confirmed that attackers accessed donor information and other sensitive data.
Source: www.bleepingcomputer.com