Two Canadians indicted for hacking US university supercomputers to steal credentials and mine cryptocurrency; one extradited
Research computing clusters are attractive because of their compute and their shared, long-lived accounts. Watch for sustained high CPU or GPU use outside scheduled jobs, logins to cluster accounts from unfamiliar VPS ranges, and new SSH keys or cron entries on login nodes.
Sources: USAO WDNY press release (Nov 3), via Public mirror · BleepingComputer: US charges two Canadians accused of hacking US universities (Nov 4)