✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
Critical Stored XSS Vulnerability in Zimbra's Briefcase Feature: CVE-2026-33370
In March 2026, a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-33370, was discovered in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. This flaw resided in the Briefcase feature, where insufficient sanitization of specific uploaded file types allowed attackers to embed malicious JavaScript. When users accessed these compromised files, the scripts executed within their session context, potentially leading to data exfiltration or unauthorized actions. Zimbra promptly addressed this issue by releasing version 10.1.19, urging all users to update their systems to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2026-33370?utm_source=openai)) The discovery of CVE-2026-33370 underscores the persistent threat posed by XSS vulnerabilities in widely used collaboration platforms. Given Zimbra's extensive user base, including numerous businesses and government agencies, timely patching is crucial to prevent potential exploitation. This incident highlights the importance of regular security assessments and prompt software updates to safeguard sensitive information.
2 weeks ago
Kill Chain
Ryuk Ransomware Operator Pleads Guilty in U.S., Faces 15 Years
In July 2026, 34-year-old Armenian national Karen Serobovich Vardanyan pleaded guilty in the United States to charges of hacking multiple U.S. companies and deploying Ryuk ransomware between November 2019 and April 2020. Vardanyan, who was extradited from Kyiv in April 2025, facilitated unauthorized access to corporate networks, leading to the encryption of systems and substantial ransom payments. Notably, a Michigan company paid 200 BTC (over $1.1 million at the time), contributing to a total of approximately 1,610 bitcoins (valued at around $15 million) extorted from victims. This case underscores the persistent threat posed by ransomware operations like Ryuk, which, at their peak, targeted around 20 organizations weekly and amassed over $150 million. The prosecution of Vardanyan highlights ongoing international efforts to combat cybercrime and hold perpetrators accountable, emphasizing the need for robust cybersecurity measures and vigilance against such attacks.
2 weeks ago
Kill Chain
Unimed Cyberattack 2026: A Wake-Up Call for Healthcare Vendor Security
In April 2026, Unimed, a German medical billing provider servicing numerous university hospitals, suffered a cyberattack resulting in the theft of over 72,000 patient records. The breach exposed sensitive information, including names, addresses, and health data. Unimed promptly reported the incident to authorities and collaborated with affected hospitals to notify impacted patients. The attack did not compromise the IT systems of the client hospitals, ensuring that patient care remained unaffected. ([luxgap.com](https://luxgap.com/articles/unimed-72000-patients-voles-dlp-article-32-transferts-rgpd?lang=en&utm_source=openai)) This incident underscores the critical vulnerabilities within third-party service providers in the healthcare sector. As cybercriminals increasingly target supply chains, healthcare organizations must reassess and fortify their vendor risk management and data protection strategies to prevent similar breaches.
2 weeks ago
Kill Chain
Helix Vishing Group Exploits SharePoint in Data Theft Attacks
In July 2026, a new data-extortion group named Helix emerged, employing sophisticated identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to infiltrate SharePoint environments. The attackers initiated contact by impersonating managers over the phone, convincing employees to provide device codes, thereby gaining unauthorized access to their accounts. Once inside, Helix operators registered new MFA applications to maintain persistence, systematically enumerated SharePoint content, and exfiltrated sensitive files. The stolen data was then used to extort victim organizations by threatening public disclosure or selling it to other cybercriminals. This incident underscores a significant shift towards identity-based attacks targeting cloud services, highlighting the vulnerabilities in current authentication processes. The Helix group's methods bear similarities to previous tactics employed by groups like ShinyHunters and BlackFile, indicating a possible evolution or rebranding of these threat actors. Organizations must reassess and strengthen their security protocols, particularly around identity verification and access controls, to mitigate the risks posed by such sophisticated social engineering attacks.
2 weeks ago
Kill Chain
GodDamn Ransomware: A New Era of BYOVD Attacks
In July 2026, the Hyadina ransomware group launched a sophisticated attack against U.S. organizations using their newly developed 'GodDamn' ransomware. The attackers employed a Bring Your Own Vulnerable Driver (BYOVD) technique, utilizing a malicious kernel driver signed by Microsoft to disable security software and facilitate the ransomware deployment. This method allowed them to infiltrate sectors including healthcare, manufacturing, and education, leading to significant operational disruptions and data encryption. This incident underscores the evolving tactics of ransomware groups, particularly the exploitation of trusted digital certificates to bypass security measures. The use of legitimate tools for malicious purposes highlights the need for enhanced behavioral detection mechanisms and adaptive security strategies to counteract such sophisticated threats.
2 weeks ago
Kill Chain
Ubiquiti UniFi OS Vulnerabilities: Immediate Action Required
In July 2026, Ubiquiti disclosed seven critical vulnerabilities in its UniFi OS ecosystem, notably CVE-2026-50746, which allows network-based attackers to execute command injection attacks on devices managing smart building operations. These flaws affect multiple UniFi applications, including Connect, Talk, Access, and Protect, as well as various hardware devices. Exploitation could lead to unauthorized control over critical infrastructure components. The widespread exposure of over 100,000 UniFi OS instances online, particularly in the United States, underscores the urgency for immediate patching. Given the history of Ubiquiti devices being targeted to build botnets, these vulnerabilities present a significant risk to both individual organizations and broader network security.
2 weeks ago
Kill Chain
CISA Mandates Immediate Patching of Critical Adobe ColdFusion Vulnerability CVE-2026-48282
In early July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability in Adobe ColdFusion, identified as CVE-2026-48282. This path traversal flaw affects versions 2025.9, 2023.20, and earlier, allowing unauthenticated remote attackers to execute arbitrary code on unpatched systems. Adobe released security updates on June 30, 2026, urging immediate deployment due to the high risk of exploitation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/?utm_source=openai)) The urgency of this directive underscores the rapid exploitation of such vulnerabilities by threat actors. Organizations must prioritize timely patching and robust vulnerability management to mitigate risks associated with critical software flaws.
2 weeks ago
Kill Chain
Hackers Exploit Roundcube Flaw to Spy on Academic Researchers
In May 2026, a China-linked threat cluster, identified as UNK_MassTraction, exploited vulnerabilities in Roundcube webmail servers at U.S. and Canadian universities. Targeting physics and engineering departments, the attackers sent malicious emails that, when opened in vulnerable Roundcube clients, triggered the execution of JavaScript code exploiting CVE-2024-42009. This led to the deployment of IceCube malware, harvesting credentials and two-factor authentication data. Further exploitation of CVE-2025-49113 allowed the installation of SquareShell, a PHP webshell, granting remote code execution capabilities. In cases where this failed, the attackers deployed VShell, a Go-based backdoor facilitating interactive shell access and port forwarding. This incident underscores the persistent threat posed by state-sponsored cyber espionage, particularly targeting academic institutions involved in sensitive research areas. The exploitation of known vulnerabilities in widely used software like Roundcube highlights the critical need for timely patching and robust security measures to protect against sophisticated attacks.
2 weeks ago
Kill Chain
Mount Royal University 2026 Ransomware Attack: A Case Study
In June 2026, Mount Royal University (MRU) in Calgary experienced a significant cyberattack attributed to the CMD Organization ransomware group. The attackers infiltrated MRU's network, exfiltrated data from the H drive—used by students and employees—and subsequently deleted the original files to hinder recovery efforts. This breach disrupted various university services, including online platforms and internal systems, affecting current and former students and staff. The university has engaged external cybersecurity experts and reported the incident to relevant authorities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/mount-royal-university-confirms-breach-as-hackers-claim-attack/?utm_source=openai)) This incident underscores the evolving tactics of ransomware groups like CMD Organization, which employ auction-based extortion models to maximize financial gain. Their approach not only involves data encryption but also public data leaks and auctions, amplifying pressure on victims. ([labs.beazley.security](https://labs.beazley.security/articles/cmd-organization-new-ransomware-operator-moves-to-place-public-bidding-wars-on-ransomed-data?utm_source=openai))
2 weeks ago
Kill Chain
CISA Highlights Active Exploitation of Critical Adobe, Joomla, and Langflow Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. These include CVE-2026-48282, a path traversal flaw in Adobe ColdFusion; CVE-2026-56290, an improper access control issue in Joomlack Page Builder; CVE-2026-55255, an authorization bypass in Langflow; and CVE-2026-48908, an unrestricted file upload vulnerability in JoomShaper SP Page Builder. Exploitation of these vulnerabilities could lead to arbitrary code execution and unauthorized access, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the urgency for organizations to apply available patches promptly. The active exploitation of these flaws highlights a trend of attackers rapidly leveraging newly disclosed vulnerabilities, emphasizing the need for vigilant vulnerability management and timely remediation strategies.
2 weeks ago
Kill Chain
CISA Highlights Three Actively Exploited Vulnerabilities in Latest KEV Catalog Update
On July 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2026-48908, an unrestricted file upload flaw in JoomShaper's SP Page Builder; CVE-2026-55255, an authorization bypass in Langflow; and CVE-2026-56290, an improper access control issue in Joomlack's Page Builder. Such vulnerabilities are commonly exploited by malicious actors, posing significant risks to federal enterprises. The inclusion of these vulnerabilities underscores the critical need for organizations to prioritize remediation efforts. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to address high-risk vulnerabilities promptly, emphasizing the importance of proactive vulnerability management to safeguard against active threats.
2 weeks ago
Kill Chain
China-Aligned Hackers Exploit Roundcube Flaws in University Attacks
In May 2026, a China-aligned threat group, identified as UNK_MassTraction, exploited critical vulnerabilities in Roundcube webmail software to infiltrate physics and engineering departments at U.S. and Canadian universities. By leveraging CVE-2024-42009, the attackers executed arbitrary JavaScript in victims' browsers, leading to credential theft. Subsequently, they exploited CVE-2025-49113 to gain persistent access via web shells or the VShell backdoor, enabling further network penetration. The campaign specifically targeted administrators and professors involved in sensitive research areas, including astrophysics and particle physics. This incident underscores the persistent threat posed by state-sponsored actors targeting academic institutions to access sensitive research data. The exploitation of known vulnerabilities in widely used software like Roundcube highlights the critical need for timely patching and robust cybersecurity measures within the education sector.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports