✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
Debate Erupts Over U.S. Ban on Anthropic's AI Models
In June 2026, the U.S. government issued an export control order restricting foreign nationals from accessing Anthropic's advanced AI models, Claude Fable 5 and Mythos 5, citing national security concerns. This led Anthropic to suspend the models' use for all customers to ensure compliance. The security community criticized the decision, arguing that it hampers defenders' access to crucial tools while doing little to prevent adversaries from developing similar capabilities. Experts highlighted that such restrictions might inadvertently accelerate the development of decentralized, open-source alternatives, potentially diminishing U.S. leadership in AI security. The incident underscores the delicate balance between national security and technological advancement, emphasizing the need for policies that support innovation while mitigating risks.
1 month ago
Kill Chain
CISA Adds CVE-2026-48907 to Known Exploited Vulnerabilities Catalog
In June 2026, a critical vulnerability identified as CVE-2026-48907 was discovered in the Joomla Content Editor (JCE) extension, allowing unauthenticated attackers to create new editor profiles and upload arbitrary PHP code, leading to remote code execution. This flaw affects JCE versions prior to 2.9.99.5. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 16, 2026, following evidence of active exploitation. Joomla released patches on June 3 and June 6, 2026, to address this issue. ([securityweek.com](https://www.securityweek.com/joomla-litespeed-vulnerabilities-exploited-in-attacks/?utm_source=openai)) The active exploitation of CVE-2026-48907 underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. Organizations are urged to promptly apply the latest security updates to mitigate potential risks associated with this vulnerability.
1 month ago
Kill Chain
New Malware Loaders Deployed in ClickFix Campaigns via Fake Updates
In June 2026, cybersecurity researchers identified multiple ClickFix campaigns deploying three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. These campaigns utilized fake software update lures to infiltrate systems, primarily targeting the education and financial sectors. The attackers' methods included sophisticated social engineering tactics to deceive users into executing malicious payloads, leading to unauthorized access and potential data exfiltration. This incident underscores a growing trend of threat actors employing novel malware delivery mechanisms and deceptive tactics to compromise organizations. The emergence of these loaders highlights the need for enhanced vigilance and adaptive security measures to counter evolving cyber threats.
1 month ago
Kill Chain
UNC6508: Unveiling the Stealthy Chinese Espionage Group Targeting North American Research
In late 2025, Google's Threat Intelligence Group identified UNC6508, a Chinese state-sponsored espionage group, which had infiltrated U.S. and Canadian organizations since September 2023. The group exploited vulnerabilities in externally facing REDCap servers to deploy a custom backdoor named INFINITERED, enabling them to steal administrative credentials and sensitive data from medical research universities, clinical providers, and military health institutions. UNC6508 remained undetected for over two years, highlighting the sophistication and stealth of their operations. ([cyberscoop.com](https://cyberscoop.com/google-unc6508-china-espionage-threat/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber espionage groups targeting critical infrastructure and sensitive research sectors. The ability of such groups to operate undetected for extended periods emphasizes the need for enhanced cybersecurity measures and vigilance within organizations handling sensitive data. ([cyberscoop.com](https://cyberscoop.com/google-unc6508-china-espionage-threat/?utm_source=openai))
1 month ago
Kill Chain
ShinyHunters Breach Infinite Campus: 137,000 School Staff Accounts Exposed
In March 2026, the ShinyHunters extortion group infiltrated Infinite Campus's Salesforce instance, compromising personal information of over 137,000 school staff members. The stolen data included names, email addresses, phone numbers, physical addresses, and support tickets. Infinite Campus, a leading EdTech provider serving over 3,200 school districts across the United States, confirmed the breach but stated that the majority of the exposed information was publicly available directory data. This incident underscores the escalating trend of cybercriminals targeting educational institutions and their service providers. The breach highlights the critical need for robust security measures and vigilant monitoring of third-party platforms to safeguard sensitive information in the education sector.
1 month ago
Kill Chain
UNC6508's Prolonged Infiltration of REDCap Servers Exposes Medical Research Vulnerabilities
Between September 2023 and November 2025, the Chinese state-sponsored group UNC6508 infiltrated vulnerable REDCap servers at a North American medical research institution. They deployed custom malware named Infinitered, which harvested credentials and established a backdoor, enabling prolonged data exfiltration. The attackers exploited REDCap's widespread use in medical research to access sensitive information undetected for over a year. This incident underscores the persistent threat posed by nation-state actors targeting critical research sectors. The sophisticated methods employed, including the abuse of legitimate features for data exfiltration, highlight the evolving tactics in cyberespionage campaigns.
1 month ago
Kill Chain
Chinese Hackers Exploit Google Workspace to Steal Sensitive Emails
Between September 2023 and November 2025, the China-linked espionage group UNC6508 infiltrated North American medical, academic, and military research networks by compromising externally facing REDCap servers. They deployed custom malware named INFINITERED, which trojanized REDCap system files to harvest login credentials and establish persistent access. With domain administrator rights, UNC6508 abused Google Workspace's content compliance rules to silently BCC emails containing specific keywords to attacker-controlled Gmail addresses, effectively exfiltrating sensitive research and defense communications without deploying additional malware or generating unusual network traffic. This incident underscores the evolving tactics of state-sponsored actors who exploit legitimate administrative features within cloud services to conduct stealthy data exfiltration. Organizations must enhance monitoring of administrative configurations and implement robust security measures to detect and prevent such abuses.
1 month ago
Kill Chain
UNC6508's Year-Long Espionage on U.S. Research Institutions
Between September 2023 and November 2025, the China-aligned threat actor UNC6508 conducted a covert cyber-espionage campaign targeting U.S. academic, medical, and military research institutions. The attackers exploited vulnerabilities in REDCap servers to deploy custom malware named Infinitered, enabling them to steal credentials and maintain persistent access. This operation led to the exfiltration of sensitive data related to defense intelligence, military strategy, artificial intelligence, and medical research. ([darkreading.com](https://www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected?utm_source=openai)) This incident underscores the evolving sophistication of state-sponsored cyber threats, highlighting the need for enhanced security measures in research institutions. The use of tailored malware and novel data exfiltration techniques by UNC6508 reflects a broader trend of advanced persistent threats employing innovative methods to achieve their objectives.
1 month ago
Kill Chain
Unveiling the Threat: 152 Malicious Chrome Extensions Compromise User Security
In June 2026, cybersecurity researchers uncovered a network of 152 Google Chrome extensions, primarily offering live wallpaper functionalities, that were distributing potentially unwanted programs (PUPs). These extensions, spanning 38 separate Chrome Web Store publisher accounts and three brand backends—tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com—had collectively amassed 105,000 installations. Despite claiming not to collect user data, the extensions' privacy policies revealed the logging of IP addresses, ISPs, click counts, and referrers, with data shared with Google AdSense, DoubleClick, and third-party ad partners. Additionally, some extensions manipulated browser behavior to simulate organic search traffic, thereby fabricating the origin of their own traffic. This incident underscores the persistent threat posed by malicious browser extensions, which can compromise user privacy and security. The deceptive practices employed highlight the need for vigilant monitoring of browser add-ons and the importance of scrutinizing privacy policies, even for seemingly benign applications.
1 month ago
Kill Chain
Former IT Employee Sentenced for Prolonged Cyberattacks on School District
In June 2026, Ezekiel Dean Potter, a former senior IT support specialist at Saydel Community School District in Des Moines, Iowa, was sentenced to 21 months in prison for conducting a series of unauthorized cyberattacks against his former employer. After his termination in April 2023, Potter retained access credentials and over the next 21 months, he deleted the district's Facebook page, disrupted access to educational platforms, and reset employee usernames and passwords, causing significant operational disruptions and financial losses estimated at tens of thousands of dollars. This incident underscores the critical importance of promptly revoking access credentials of departing employees and implementing robust monitoring systems to detect unauthorized access. The case highlights the potential risks posed by insider threats and the necessity for organizations to enforce strict access control policies to safeguard their digital assets.
1 month ago
Kill Chain
ShinyHunters' Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
Between May 27 and June 9, 2026, the cyber extortion group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, specifically targeting the Environment Management Hub (EMHub). This critical flaw allowed unauthenticated remote code execution, leading to the compromise of over 100 organizations, predominantly in the higher education sector. The attackers exfiltrated sensitive data from approximately 300 PeopleSoft instances, including personal and financial information of students and staff. Oracle released a security advisory and patch on June 10, 2026, urging immediate action to mitigate the risk. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/shinyhunters-oracle-zero-day-higher-ed?utm_source=openai)) This incident underscores the increasing targeting of educational institutions by cybercriminals exploiting unpatched vulnerabilities in widely used enterprise software. The rapid exploitation of zero-day vulnerabilities highlights the necessity for organizations to implement proactive vulnerability management and incident response strategies to protect sensitive data and maintain operational integrity.
1 month ago
Kill Chain
Critical Unauthenticated RCE Vulnerability in Oracle PeopleSoft Exploited: CVE-2026-35273
In early June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in its PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component. This flaw, present in versions 8.61 and 8.62, allows unauthenticated attackers with network access via HTTP to execute remote code, potentially leading to full system compromise. The vulnerability was actively exploited between May 27 and June 9, 2026, before Oracle released a patch on June 10. Over 100 organizations were affected, with data exfiltration reported from nearly 300 PeopleSoft instances. The cyber extortion group ShinyHunters is believed to be behind these attacks, though some experts suggest possible impersonation. ([techradar.com](https://www.techradar.com/pro/security/oracle-warns-customers-of-critical-peoplesoft-attack-after-hundreds-of-servers-hacked-by-apparent-shinyhunters-data-theft-attacks?utm_source=openai)) This incident underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in widely used enterprise applications. The rapid exploitation of CVE-2026-35273 highlights the importance of timely patch management and proactive monitoring to detect and mitigate such threats before they can cause significant damage.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports