✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
PowerSchool 2024 Data Breach: College Student Sentenced for Massive Attack
In December 2024, PowerSchool, a major provider of cloud-based education technology, suffered a significant data breach orchestrated by 19-year-old college student Matthew D. Lane from Worcester, Massachusetts. Lane infiltrated PowerSchool’s systems by exploiting a combination of credential theft and vulnerabilities in internal access controls, enabling him to exfiltrate large volumes of sensitive student and faculty data over several weeks. Law enforcement investigation led to his arrest and subsequent sentencing to four years in prison, highlighting both the sophistication of modern attackers and the sensitivity of educational data targeted. The case is especially relevant as threat actors increasingly set their sights on critical SaaS platforms and education technology, exploiting gaps in zero trust implementation and east-west traffic visibility. The incident underscores a rising trend in data breaches against public sector organizations and the urgent need for robust controls in cloud and hybrid environments.
6 months ago
Kill Chain
Microsoft’s October 2025 Patch Tuesday Highlights Critical Vulnerabilities and End-of-Support Urgency
In October 2025, Microsoft released security updates addressing 157 vulnerabilities across several on-premises products as part of its Patch Tuesday initiative. Eight vulnerabilities were rated critical, with impacted platforms including Windows 10, Office 2016/2019, Exchange Server 2016/2019, and various core components (e.g., Excel, Remote Desktop, SharePoint). While no active exploitation was reported at the time of disclosure, the sheer number and severity of these flaws—including several involving remote code execution and privilege escalation—pose significant risks for enterprises relying on legacy or end-of-support software. Organizations dependent on affected Microsoft software are urged to apply patches promptly and consider their exposure, particularly as support for key products ends and attackers often target unpatched environments. This Patch Tuesday is highly relevant as attackers consistently exploit newly disclosed vulnerabilities, especially in widely deployed systems, for lateral movement and data exfiltration. With mainstream support ending for core Microsoft products, the window of exposure and regulatory risk grows for companies slow to adopt updated versions or enhanced security controls.
6 months ago
Kill Chain
Oracle EBS Zero-Day: How ShinyHunters and Clop Launched 2025's Most Notorious Data Extortion Attacks
In October 2025, Oracle silently released out-of-band patches for a critical zero-day vulnerability (CVE-2025-61884) in its E-Business Suite, following active exploitation by the ShinyHunters extortion group. The flaw allowed attackers to perform unauthenticated Server-Side Request Forgery (SSRF) and potentially remote code execution, leading to unauthorized access and data theft from affected servers. Clop ransomware actors also launched parallel extortion campaigns targeting Oracle EBS customers, leveraging separate yet related zero-day vulnerabilities to steal sensitive corporate data and demand ransom payments. Multiple exploits and proofs-of-concept were shared publicly, increasing organizational risk and pressure for rapid patching. This incident underscores the growing sophistication and collaboration among ransomware and extortion groups exploiting enterprise zero-day vulnerabilities for data theft and financial gain. The release and weaponization of public exploits highlight a rising trend of supply chain risk and the urgent need for continuous vulnerability management, proactive patching strategies, and advanced east-west traffic controls.
6 months ago
Kill Chain
Windows 10 End-of-Support: Patch Tuesday Signals Urgent Lifecycle Risk in 2025
In October 2025, Microsoft released KB5066791, the final mandatory Patch Tuesday update for Windows 10 as the operating system officially reached end-of-support status. This update addressed six zero-day vulnerabilities and 172 additional flaws. With free support and security updates discontinued, only customers enrolled in extended security updates (ESUs) are eligible for further patches. The shift leaves millions of endpoints—including in enterprise and consumer environments—potentially vulnerable to emerging threats targeting unpatched or unsupported Windows 10 systems as threat actors historically target end-of-life platforms for exploitation. The update also modified components like the Azure validation chain and removed outdated drivers, signaling a definitive end to mainstream security support. This event is particularly significant due to the accelerated exploitation trends observed following previous Microsoft OS end-of-life events. Attackers rapidly pivot to leverage newly found or previously unreported vulnerabilities, resulting in heightened lateral movement and potential compliance risks. Organizations must act swiftly to upgrade, implement segmentation, and enhance detection capabilities to avoid becoming easy targets.
6 months ago
Kill Chain
How Hacktivists Used Hashtags and DDoS to Disrupt in 2025
In early 2025, a surge in global hacktivist operations was observed, coordinated primarily via Telegram and X (formerly Twitter), with attackers leveraging hashtags to claim credit, issue threats, and organize campaigns. Over 120 hacktivist groups, originating in the MENA region but targeting organizations worldwide—including government, finance, and critical infrastructure—conducted highly visible DDoS attacks. These operations favored impact and propaganda over technical sophistication, resulting in significant service disruptions and reputational challenges for numerous victims, with attack announcements and proof frequently disseminated in near real-time. The campaign reflects a broader shift toward open, social-media-driven hacktivist tactics that often transcend regional geopolitics. As DDoS tools become more accessible and social platforms amplify coordination, all organizations—regardless of direct involvement in conflicts—face increased risk from ideologically motivated cyberattacks.
6 months ago
Kill Chain
Harvard University Hit by Clop Ransomware Through Oracle Zero-Day Exploit in 2025
In October 2025, Harvard University disclosed an ongoing investigation into a cybersecurity breach linked to the exploitation of a zero-day vulnerability (CVE-2025-61882) in Oracle's E-Business Suite servers. The Clop ransomware gang claimed responsibility after adding Harvard to its data leak site, stating sensitive administrative data was stolen and threatening public release if ransom demands were not met. The attack was part of a broader campaign targeting Oracle E-Business Suite customers globally, exploiting the flaw for extortion and data theft. Harvard applied the vendor’s emergency patch upon notification and reported the breach as limited to a small administrative unit, with no signs of further compromise. This incident underscores the continuous risk universities and other organizations face from sophisticated ransomware groups leveraging zero-day exploits to bypass conventional defenses. The rapid exploitation of newly discovered vulnerabilities and subsequent data thefts reflect an ongoing shift towards extortion-focused campaigns targeting high-profile institutions and critical business systems.
6 months ago
Kill Chain
Universities Targeted: Storm-2657 Orchestrates 2025 Business Email Compromise via Payroll Phishing
In March 2025, a financially motivated threat group tracked as Storm-2657 launched a series of "payroll pirate" attacks targeting U.S. university staff. The attackers leveraged advanced social engineering and adversary-in-the-middle (AITM) phishing techniques to compromise HR-related SaaS accounts, notably Workday. After stealing MFA credentials, they accessed Exchange Online accounts, manipulated payroll settings to hijack salary payments, set inbox rules for concealment, and enrolled attacker-controlled MFA devices for persistence. At least 11 accounts across three universities were breached, enabling phishing campaigns to almost 6,000 recipients spanning 25 institutions. The incident showcases a significant escalation in business email compromise (BEC) targeting the education sector, exploiting gaps in MFA and SSO implementations. With BEC attacks surging industry-wide—resulting in multimillion-dollar annual losses—this campaign emphasizes the urgent need for phishing-resistant MFA and robust email monitoring across academia and beyond.
6 months ago
Kill Chain
OpenAI 2024: Threat Actors Weaponize AI to Supercharge Cyber Operations
In 2024, OpenAI’s threat intelligence team uncovered the widespread use of its AI platforms by a variety of state-affiliated and criminal threat actors to automate and strengthen existing cyberattack workflows. Rather than inventing novel threats, adversaries—including Chinese and North Korean clusters—integrated AI tools like ChatGPT into traditional hacking playbooks: malware development, reconnaissance, spearphishing, and influence campaigns. Notable incidents involved coordinated social media manipulation and the leveraging of LLMs for deep reconnaissance or scam orchestration, sometimes in multi-account structures mirroring factory-style operations. This incident highlights an acute shift where AI serves as a force multiplier—making known attacks faster and more scalable, not necessarily more innovative. The continued exploitation of AI by both state and non-state actors underscores urgent needs for security defenses aligned to emerging AI-driven TTPs and for regulatory guidance on responsible AI use.
6 months ago
Kill Chain
Storm-1175 Exploits GoAnywhere Zero-Day to Orchestrate Ransomware Attacks in 2024
In September 2024, Microsoft Threat Intelligence announced that Storm-1175, a financially motivated ransomware affiliate, exploited a critical zero-day vulnerability (CVE-2025-10035) in Fortra's GoAnywhere MFT file transfer solution. Attackers gained remote code execution, established persistence via remote monitoring tools and web shells, performed lateral movement using legitimate Windows utilities, and exfiltrated data with Rclone before deploying Medusa ransomware in targeted organizations. Impacted sectors included transportation, education, retail, insurance, and manufacturing. The initial compromises began on September 11, days before the vulnerability was publicly disclosed or patched, giving attackers a significant advantage and facilitating stealthy, high-impact breaches due to delayed vendor transparency. This incident highlights the escalating sophistication of ransomware operations leveraging zero-day exploits and legitimate IT tools to evade detection, resulting in substantial business disruption and data loss. Growing regulatory scrutiny and industry concern underscore the urgent need for rapid threat intelligence sharing, proactive zero trust measures, and improved vendor communication in light of similar recent attacks.
6 months ago
Kill Chain
Oracle Zero-Day Breach: Clop Ransomware Group Orchestrates Global Data Theft in 2024
In mid-2024, the Clop ransomware gang exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, executing a sophisticated chain of exploits for unauthorized, pre-authenticated remote code execution. Attackers infiltrated multiple enterprise and public-sector environments, stealing significant volumes of data before issuing high-dollar extortion demands—some as high as $50 million. The breaches went undetected for weeks, with Oracle disclosing the flaw only after victims began receiving ransom emails and the U.S. CISA catalogued the vulnerability as actively exploited. This incident underscores the rapid weaponization of newly discovered vulnerabilities by well-resourced threat actors. As enterprises increase reliance on complex ERP systems, threats leveraging zero-day exploits and multi-bug chains have become a pressing concern, signaling the need for enhanced threat detection, segmentation, and zero-trust controls.
6 months ago
Kill Chain
Clop Ransomware Exploits Oracle EBS Zero-Day for Massive Data Theft in 2025
In October 2025, Oracle urgently patched a critical zero-day vulnerability (CVE-2025-61882) affecting Oracle E-Business Suite (EBS) after widespread exploitation by the Clop ransomware gang. The flaw enabled unauthenticated remote code execution via the Concurrent Processing component’s BI Publisher integration, letting attackers gain unauthorized access and exfiltrate data. Threat actors, including Clop and possibly affiliated groups, used public proof-of-concept exploits—some leaked by other cybercriminals—to breach multiple organizations’ Oracle EBS servers. Victims were extorted via email, with stolen data leveraged for ransom, highlighting material operational and reputational risks. This incident underscores the persistent targeting of enterprise software zero-days by organized ransomware groups. The increased speed of exploit weaponization and the public sharing of exploit code amplify the urgency for organizations to apply patches swiftly, harden business-critical systems, and enhance detection capabilities for lateral movement and data exfiltration.
6 months ago
Kill Chain
Oracle E-Business Suite Hit by Cl0p: CVE-2025-61882 Breach Exposes Enterprise Data
In October 2025, Oracle urgently released a security patch addressing CVE-2025-61882, a critical vulnerability in its E-Business Suite platform with a CVSS score of 9.8. The flaw, allowing unauthenticated remote attackers network access via HTTP, was actively exploited by the Cl0p ransomware gang in a series of data theft attacks. Threat actors leveraged the bug to gain control of impacted systems, enabling lateral movement and the exfiltration of sensitive business data. Oracle customers with exposed E-Business Suite deployments were specifically targeted, prompting a rapid, emergency response. This incident highlights the resurgence of large-scale supply chain ransomware attacks exploiting zero-day vulnerabilities in widely used enterprise software. Threat actors like Cl0p are increasingly automating exploitation campaigns, raising the bar for threat detection, patch management, and regulatory compliance requirements in digital enterprises.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports