✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
Clop Ransomware Hits Gladinet CentreStack: 2025 Data Theft Alert
In December 2025, the Clop ransomware gang initiated a widespread extortion campaign by exploiting internet-facing Gladinet CentreStack file servers. Gladinet CentreStack, used by thousands of businesses worldwide, enables remote file sharing without VPNs. The attackers scanned for accessible servers, exploited a yet-undetermined (potentially zero-day or unpatched) vulnerability, and exfiltrated sensitive business data, leaving ransom notes for victims. The breaches escalated concerns after Clop’s history with major file transfer solutions, such as MOVEit and Oracle EBS, resulting in significant data leaks and operational disruption for affected organizations. This attack underscores the persistent risk posed by sophisticated ransomware groups exploiting file transfer and sharing platforms. With attackers rapidly leveraging unknown or unpatched security flaws, enterprises must prioritize robust vulnerability management for all internet-exposed assets and monitor threat actor trends targeting remote-access file servers.
6 months ago
Kill Chain
University of Sydney 2024 Data Breach Exposes Student and Staff Details
In June 2024, the University of Sydney disclosed a data breach following unauthorized access to an online coding repository. Attackers exfiltrated files containing personal information of students and staff by exploiting weak access controls on the system. The breach was identified after suspicious activity was detected, prompting immediate investigation and containment steps by the university. Impacted data reportedly includes names, contact details, and university credentials, potentially exposing the affected individuals to heightened phishing and identity theft risks. This breach underscores increasing attacks on educational institutions using supply chain and cloud repository vectors. With universities under pressure to rapidly digitize, protecting developer and collaboration tools has become critical amid surging credential-based attacks and regulatory scrutiny of personally identifiable information (PII) handling.
6 months ago
Kill Chain
React2Shell Breach: 2025’s Most Widespread Mass Exploitation Campaign
In December 2025, the React2Shell vulnerability (CVE-2025-55182) triggered a global mass exploitation campaign targeting organizations across critical infrastructure, government, and private sectors. Following public disclosure, a record number of exploits surfaced, enabling unauthenticated attackers to gain remote code execution, deploy backdoors, and move laterally within networks. High-profile cybercriminal, ransomware, and nation-state actors—including several Chinese espionage groups—converged to leverage React2Shell for data theft, ransomware deployment, and persistent access. More than 60 organizations confirmed compromise, with hundreds of machines affected, some suffering rapid ransomware execution within minutes of initial access. This incident is notable for both its rapid exploitation timeline and evolving threat actor diversity. The widespread availability of public exploits and patch bypasses underscores the urgent need for robust patch management, active detection, east-west traffic controls, and zero trust segmentation as attackers swiftly weaponize newly disclosed vulnerabilities at unprecedented speed.
6 months ago
Kill Chain
ForumTroll APT Strikes Again: Russian Political Scientists Hit by Sophisticated Phishing Scheme
In October 2025, the ForumTroll advanced persistent threat (APT) group launched a spear-phishing campaign targeting Russian political science scholars and researchers. Victims received personalized emails disguised as plagiarism report notifications from a fake scientific library domain, prompting them to download a malicious archive. Opening the archive triggered a PowerShell-based attack chain, culminating in the deployment of the Tuoni red-teaming framework via a custom obfuscated loader, with persistence achieved through COM Hijacking. Attacker infrastructure included typosquatted domains and Fastly-based C2 servers. This incident underscores the increasing shift by APT actors to highly targeted, socially engineered phishing attacks, even when technical sophistication is dialed back. Organizations must contend with the reality of persistent, multi-phase campaigns adapting both commercial and bespoke toolkits, heightening the urgency for advanced detection and resilient user training.
6 months ago
Kill Chain
ForumTroll Launches Sophisticated Phishing Attack on Russian Scholars Using Fake eLibrary Emails
In October 2025, Operation ForumTroll, a previously identified threat actor, launched a targeted phishing campaign against Russian academic and scholarly communities. Using convincingly crafted phishing emails that impersonated official eLibrary notifications, attackers distributed malicious attachments designed to harvest credentials and enable broader espionage operations. The campaign, identified by Kaspersky, marks a decisive tactical shift from prior attacks on organizations to focused targeting of individuals, raising concerns about the security posture of research and educational institutions in the region. This incident highlights the increasing trend of sophisticated phishing campaigns that employ social engineering and trusted brands to bypass traditional defenses. The focused targeting of scholars and intellectuals points towards a rise in espionage-motivated threats seeking sensitive research data, emphasizing the need for robust user education, multifactor authentication, and advanced anomaly detection.
6 months ago
Kill Chain
How RansomHouse's 2025 Encryption Upgrade Disrupted Critical Sectors
In December 2025, the RansomHouse ransomware-as-a-service (RaaS) group, operated by the Jolly Scorpius threat actor, was observed deploying a significantly upgraded encryption process against high-value victims. Attackers exploited compromised credentials and ESXi server vulnerabilities to infiltrate enterprise environments, moving laterally and using tools like MrAgent to disable firewalls and maintain persistent access. Once established, they deployed the enhanced Mario encryptor, which used multi-layered, two-stage file encryption and selective chunk processing to maximize data disruption. This double extortion campaign resulted in data theft, operational outages, and public leaks for at least 123 organizations across healthcare, finance, government, and transportation sectors. This incident highlights both the increasing technical sophistication of ransomware operations and the rapid evolution of RaaS offerings. The shift to more complex encryption makes detection, containment, and recovery far more challenging, calling for organizations to adopt dynamic, layered security controls and anticipate future trends in ransomware capabilities.
6 months ago
Kill Chain
Johnson Controls IoT Devices Exposed: 2025 Encryption Vulnerabilities in PowerG, IQPanel & IQHub
In December 2025, security researchers at NCC Group identified and responsibly disclosed four cryptographic vulnerabilities (CVE-2025-61738, CVE-2025-61739, CVE-2025-26379, CVE-2025-61740) impacting Johnson Controls’ PowerG, IQPanel, and IQHub products. The flaws included cleartext transmission of sensitive information, nonce reuse, weak pseudo-random number generation, and inadequate origin validation. Threat actors could exploit these issues to intercept, decrypt, or manipulate encrypted wireless traffic, potentially altering system behavior or disrupting services in commercial facilities globally. Johnson Controls issued advisories and firmware updates, especially urging customers to migrate to IQPanel 4 with firmware 4.6.1 or later. The incident highlights the continued importance of secure-by-design principles in IoT and OT devices, as attacks increasingly pivot toward embedded and building automation systems. Heightened regulatory focus and attacker sophistication underscore the need for proactive vulnerability management and segmenting critical infrastructure networks.
6 months ago
Kill Chain
React2Shell Exploitation: Global RCE Wave Sparks Emergency Security Response
In December 2025, the React2Shell vulnerability (CVE-2025-55182) emerged as a critical remote code execution flaw impacting React Server Components and several key frameworks such as Next.js, Vite, and RedwoodSDK. Threat actors rapidly exploited the unauthenticated deserialization bug, enabling arbitrary privileged JavaScript execution with a single HTTP request. Within days of public disclosure, multiple malicious campaigns leveraged the flaw to deploy malware, compromise sensitive systems—including government, critical infrastructure and technology entities—and conduct mass internet-wide scans. Over 137,200 exposed endpoints were tracked globally, prompting CISA to issue an accelerated mitigation deadline and security vendors to warn of global supply chain risks. React2Shell’s exploitation highlights the growing trend of mass-scale, opportunistic attacks leveraging zero-day vulnerabilities in widely-used cloud-native frameworks. With parallels drawn to systemic exploits like Log4Shell, organizations face rising regulatory and supply chain scrutiny to strengthen cloud security and incident response practices.
6 months ago
Kill Chain
NANOREMOTE: Google Drive-Enabled APT Breach Targets Global Sectors in 2025
In late 2025, security researchers discovered a sophisticated cyber-espionage campaign leveraging a new Windows backdoor known as NANOREMOTE. This malware, attributed to the Chinese-linked threat cluster REF7707 (also called Jewelbug), exploited the Google Drive API for covert command-and-control and data exfiltration. Driven by a loader mimicking legitimate security software, the attack targeted government, defense, telecommunications, education, and aviation organizations across Southeast Asia and South America. NANOREMOTE's powerful features supported reconnaissance, file operations, and encrypted communications, enabling stealthy operations and persistent access for attackers. The initial infection vector remains unknown, but the malware's modular task management and file transfer facilities allowed efficient data theft and staged payload delivery undetected by many security controls. This incident exemplifies emerging threat trends where advanced persistent threat actors abuse benign, widely trusted cloud APIs to hide their operations. As similar tradecraft spreads, organizations face heightened risks of deep lateral movement, multifaceted data breaches, and regulatory scrutiny. Continuous improvements in east-west security and traffic visibility are critical as attackers innovate with cloud-native exfiltration channels.
6 months ago
Kill Chain
React2Shell: 2025’s Supply Chain Cyberattack Shocks 50+ Organizations
In June 2025, a surge of attacks leveraging the critical React2Shell vulnerability (CVE-2025-55182) swept across more than 50 organizations globally. The flaw, located in React Server Components and derivatives like Next.js, enabled diverse threat actors ranging from nation-states (notably North Korean and Chinese groups), cybercriminals, and botnets to achieve remote code execution. Attackers exploited unpatched instances, deploying a range of malware—including cryptominers, ransomware, and backdoors such as Mirai, XMRIG, and BPFDoor—affecting entities in finance, tech, education, government, and more. The incident’s rapid expansion was facilitated by the widespread availability of public proof-of-concept exploits and slow organizational patching. The React2Shell crisis highlights the fragility of the software supply chain and the speed at which novel exploits can be adapted by a wide array of adversaries. Security and regulatory scrutiny is intensifying, with urgent patching deadlines and increased concern due to the vulnerability’s ease of exploitation, high automation, and ability to evade traditional controls, reminiscent of the earlier Log4Shell incident.
6 months ago
Kill Chain
React2Shell Exploitation Delivers Crypto Miners and Advanced Malware Across Multiple Sectors
In December 2025, a sophisticated multi-vector cyber campaign exploited a critical vulnerability (CVE-2025-55182) in React Server Components, enabling unauthenticated remote code execution across more than 50 organizations in industries including construction, entertainment, finance, and government. Attackers orchestrated automated scans to identify vulnerable Next.js deployments and delivered a suite of malware, notably the PeerBlight backdoor, CowTunnel reverse proxy, ZinFoq implant, and various cryptominers. The campaign leveraged both Linux and Windows endpoints, indicating indiscriminate targeting. Highly persistent payloads established robust command-and-control connections, enabled lateral movement, and facilitated data exfiltration while evading detection using masquerading and decentralized C2 mechanisms. This incident underscores the urgency of prompt patching for popular web frameworks and highlights the growing sophistication and prevalence of automated exploitation tools. Security teams face amplified risk as threat actors now combine opportunistic cryptomining with advanced post-exploitation techniques across geographic regions and sectors, outpacing conventional defenses and incident response speeds.
6 months ago
Kill Chain
Festo LX Appliance Security Alert: 2025 Cross-Site Scripting Vulnerability Exposes ICS Risks
In December 2025, Festo SE & Co. KG disclosed a cross-site scripting (XSS) vulnerability (CVE-2021-23414) affecting the Festo LX Appliance, impacting versions released before June 2023. Malicious actors could exploit improper input neutralization in the 'track' tag's 'src' attribute to execute arbitrary code by crafting a malicious course, potentially compromising highly privileged user accounts. Though no public exploitation has been reported, the vulnerability posed risks to organizations in critical sectors globally, with a CVSS v3.1 base score of 6.1 indicating a moderate threat profile. This incident underscores the persistent risks posed by web application vulnerabilities in ICS and OT environments. With the increased digitization of operational systems and ongoing cyberattacks targeting critical infrastructure, rapid identification, patching, and monitoring of such flaws remain crucial to protect sensitive assets and maintain compliance with evolving regulatory standards.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports