Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Higher Education/Acadamia

Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.

490 threat reports
Page 37 of 41
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Higher Education/Acadamia Threat Reports

Showing 433–444 / 490 reports
Oracle Identity Manager 2025: CVE-2025-61757 Authentication Bypass Exposed
Financial Services10 months ago

Oracle Identity Manager 2025: CVE-2025-61757 Authentication Bypass Exposed

In September 2025, multiple attacks targeted Oracle Identity Manager (OIM) instances by exploiting a critical authentication bypass vulnerability (CVE-2025-61757). The flaw, discovered by Searchlight Cyber and addressed in Oracle's October 21, 2025 Critical Patch Update, allows threat actors to append ';.wadl' to a URL, accessing privileged functionality without authentication. Logs show attackers conducted scans and POST requests using a consistent user-agent from diverse IPs before an official patch was released, evidencing rapid exploit development and the risk of remote code execution. This incident highlights the increasing threat posed by trivial, mass-scannable web application flaws in identity platforms and the speed at which adversaries weaponize new zero-day vulnerabilities. Cybersecurity teams must prioritize rapid patching and detection of unusual authentication exemption patterns to reduce critical risk exposure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025
Construction10 months ago

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

In November 2025, Automated Logic disclosed critical vulnerabilities impacting multiple legacy versions of its WebCTRL Premium Server and related Carrier i-Vu and SiteScan Web products. Reported by researchers Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine, the flaws—CVE-2024-8527 (Open Redirect) and CVE-2024-8528 (Cross-site Scripting)—could allow remote attackers to deceive users into navigating to malicious sites or executing attacker-controlled scripts. These vulnerabilities affect industrial control solutions deployed globally within the Critical Manufacturing sector, potentially enabling credential theft, phishing, or unauthorized access to sensitive building automation environments. This incident underscores the urgent need for timely patching and secure software development in critical infrastructure industries. As web application attacks increase and threat actors target supply chain and operational technology, coordinated disclosures and swift remediation remain vital to reduce risk and comply with tightening regulatory frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk
Higher Education/Acadamia10 months ago

Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk

In November 2025, Festo SE & Co. KG disclosed a supply chain vulnerability affecting its Didactic products due to the integration of vulnerable versions of Siemens TIA Portal (V15–V18). The issue, tracked as CVE-2023-26293, stems from improper input validation, allowing attackers to leverage a path traversal flaw. This could result in the creation or overwriting of arbitrary files if a user is tricked into opening a malicious PC system configuration file, leading to potential arbitrary code execution. The exploit, which requires local access with user interaction, impacts engineering systems used globally across critical sectors, including manufacturing, energy, communications, and commercial facilities. This vulnerability is significant as it illustrates the increasing prevalence of supply chain risks in industrial and critical infrastructure software. With threat actors increasingly exploiting the software supply chain and user-driven entry vectors, maintaining rigorous update and validation processes has become a pressing challenge for organizations worldwide.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags New Chromium Browser Exploit: CVE-2025-13223 in Active Use
Financial Services10 months ago

CISA Flags New Chromium Browser Exploit: CVE-2025-13223 in Active Use

On November 19, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-13223—an actively exploited type confusion vulnerability in the Google Chromium V8 JavaScript engine—to its Known Exploited Vulnerabilities (KEV) Catalog. This flaw allows remote attackers to execute arbitrary code via a crafted web page, exploiting weaknesses in Chromium-based browsers used by federal and commercial entities. Threat actors have been leveraging this vulnerability to deliver malware and potentially gain unauthorized access to systems, heightening risk across government and enterprise environments. This incident is highly relevant as attackers continue to target zero-day and rapidly weaponized browser flaws, reflecting a broader trend of exploiting client-side vulnerabilities to bypass traditional network defenses. Regulatory and industry pressure for rapid patch management and strong endpoint protection is intensifying as attackers' tactics evolve.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unicode: The Hidden Security Threat Fueling 2024's Obfuscated Code Attacks
Computer Software/Engineering10 months ago

Unicode: The Hidden Security Threat Fueling 2024's Obfuscated Code Attacks

In late 2024, security researchers highlighted a series of application security vulnerabilities caused by improper handling of the Unicode character set, impacting numerous platforms and development environments. Attackers exploited Unicode features such as confusable characters, variant selectors, and bidirectional text markers, enabling impersonation, injection, and severe obfuscation of code in public repositories. Notably, a self-propagating worm known as "Glass Worm" leveraged invisible Unicode code points to disguise malicious code in Visual Studio Code extensions, bypassing manual code review and automated security checks. These techniques led to increased risk of code injection, credential spoofing, and long-term compromise of software supply chains. Unicode-driven attack techniques continue to gain prominence due to their effectiveness at evading human and automated detection. The recent spike in attacks demonstrates a broader trend towards supply chain risk and advanced code obfuscation, demanding urgent attention to Unicode normalization, secure coding practices, and robust detection mechanisms in compliance-driven industries.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Hackers Exploit Ray AI to Launch Global Cryptojacking Botnet (2024)
Information Technology/IT10 months ago

Hackers Exploit Ray AI to Launch Global Cryptojacking Botnet (2024)

In late 2024, malicious actors exploited an unauthenticated remote code execution vulnerability (CVE-2023-48022) in the open-source Ray AI framework, transforming exposed development environments into a globally distributed cryptojacking operation. Attackers leveraged Ray's scheduling and orchestration APIs to gain unauthorized access and deploy cryptomining payloads, particularly targeting environments with premium NVIDIA A100 GPUs. The campaign, identified by Oligo Security, unfolded in multiple phases: after initial malware delivery via GitLab infrastructure was disrupted, attackers quickly shifted to hosting on GitHub to sustain their operation. Over 200,000 exposed Ray clusters worldwide were at risk, significantly impacting cloud AI operations, startups, and research environments. This incident marks a major evolution in threat actor adaptation: rather than exploiting traditional network vulnerabilities, adversaries weaponized trusted automation features to evade detection and maximize illicit gain. The campaign illustrates mounting risks to cloud-hosted AI workloads, the dangers of insecure API exposure, and the urgent need for stringent internal network controls to defend against cryptojacking and abuse of compute resources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Princeton University Data Breach Exposes Alumni and Donor Information
Higher Education/Acadamia10 months ago

Princeton University Data Breach Exposes Alumni and Donor Information

On November 10, 2023, Princeton University experienced a significant data breach when unauthorized actors gained access to a university database containing sensitive information on alumni, donors, students, and faculty. The intrusion exposed personal details such as names, contact information, and donation records, with initial reports indicating the compromise originated from the university’s advancement and fundraising systems. Princeton moved quickly to secure impacted systems, notify affected individuals, and engage cybersecurity experts and law enforcement. The exposure raises concerns regarding the safeguarding of high-value personal and financial data held by educational institutions. This incident underscores the persistent threat higher education institutions face from cyberattacks targeting personal and philanthropic data. The Princeton breach highlights a surge in attacks exploiting third-party platforms and unencrypted internal data flows, aligning with broader trends toward increased ransomware and data extortion pressures observed throughout 2023.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
RondoDox Botnet Exploits Unpatched XWiki Servers via CVE-2025-24893
Information Technology/IT10 months ago

RondoDox Botnet Exploits Unpatched XWiki Servers via CVE-2025-24893

In November 2025, cybersecurity researchers identified a widescale campaign leveraging the RondoDox botnet to exploit unpatched XWiki server instances. Attackers targeted CVE-2025-24893—a critical eval injection vulnerability with a CVSS score of 9.8—allowing unauthenticated remote code execution through manipulated HTTP requests. Once compromised, affected XWiki servers were conscripted into the botnet, enabling further lateral spread and facilitating command-and-control capabilities for adversaries. Organizations reliant on XWiki for content collaboration faced outages, data exposure, and the threat of secondary attacks as RondoDox rapidly weaponized unremediated systems. The RondoDox campaign underscores a growing trend in the automated exploitation of high-severity vulnerabilities in open-source platforms. As threat actors increasingly target collaborative SaaS and wiki services, enterprises face heightened demands for rapid patch management, proactive threat detection, and adherence to zero trust principles to minimize supply chain risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Flags Akira Ransomware as Top Threat to US Critical Infrastructure in 2024
Health Care / Life Sciences10 months ago

FBI Flags Akira Ransomware as Top Threat to US Critical Infrastructure in 2024

In September 2024, federal cyber authorities, including the FBI and CISA, issued a joint advisory detailing the significant threat posed by the Akira ransomware group. First identified in March 2023, Akira employs double-extortion tactics—stealing sensitive data before encrypting systems—to pressure victims for ransom. The group is associated with additional threat actors and has links to the former Conti operation. Akira has accumulated over $244 million in illicit proceeds by targeting small and medium-sized businesses, impacting sectors such as manufacturing, education, healthcare, IT, finance, and agriculture. The group leverages known vulnerabilities in critical infrastructure software, exploits stolen credentials, and uses remote access tools to compromise organizations, often exfiltrating data in just over two hours. The FBI considers Akira among its top five most consequential ransomware variants, reflecting a broader trend of increasingly sophisticated, fast-moving, and costly ransomware attacks. Recent activity highlights the group’s adaptability and operational security, reinforcing the urgent need for organizations to harden defenses as ransomware tactics evolve.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Akira Ransomware 2025: How Edge Device Vulnerabilities Fueled Infrastructure Attacks
Health Care / Life Sciences10 months ago

Akira Ransomware 2025: How Edge Device Vulnerabilities Fueled Infrastructure Attacks

In November 2025, the Akira ransomware group and affiliates such as Storm-1567 and Howling Scorpius intensified attacks on critical infrastructure sectors by exploiting edge device and backup server vulnerabilities. Threat actors leveraged techniques including authentication bypass, brute-force credential attacks, and the deployment of new Akira_v2 malware for rapid encryption. Their sophisticated methods involved lateral movement through RDP/SSH, defense evasion with remote tools (Anydesk, LogMeIn), disabling security controls, and stealthy data exfiltration via FTP/SFTP/cloud channels. Impacted sectors ranged from Manufacturing and Education to Healthcare and Finance, resulting in encrypted systems, data theft, and serious operational disruption. This incident underscores the persistent evolution of ransomware tactics and the growing threat to organizations of all sizes. The prevalence of supply chain risks, rapid malware adaptation, and exploitation of misconfigured or outdated security perimeters demand continuous vigilance and investment in advanced detection, rapid patching, and segmentation strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Credential Stuffing at Scale: 2 Billion Email Addresses and 1.3 Billion Passwords Exposed in 2025
Financial Services10 months ago

Credential Stuffing at Scale: 2 Billion Email Addresses and 1.3 Billion Passwords Exposed in 2025

In late 2025, a massive credential stuffing incident came to light when nearly 2 billion email addresses and 1.3 billion unique passwords – sourced over years from various cybercriminal forums and compromised stealer logs – were aggregated and indexed by Synthient, then processed by Have I Been Pwned (HIBP) for user notification. The dataset included credentials from countless breaches, consolidated into one of the largest exposures of its kind to date. While the original leaks stemmed from malware infections, phishing, and prior breaches, the impact was compounded by password reuse and the easy redistribution of these records in the criminal underground. HIBP took technical and privacy-preserving steps to verify and notify affected users while preventing further risk of data linkage. This incident illustrates the ongoing risks posed by credential stuffing and highlights the long lifecycle of exposed data as threat actors continuously recycle and combine compromised information. The event underscores the importance of password hygiene, multi-factor authentication, and proactive notification as recycled data fuels ongoing cyberattacks across industries.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
University of Pennsylvania 2024 Data Breach: Alumni and Donor Information Compromised
Higher Education/Acadamia10 months ago

University of Pennsylvania 2024 Data Breach: Alumni and Donor Information Compromised

In June 2024, the University of Pennsylvania confirmed a data breach involving unauthorized access to several internal systems linked to its development and alumni activities. Attackers infiltrated the university’s IT infrastructure, resulting in the theft of sensitive personal and institutional data. The breach impacted donors, alumni, and staff, exposing information such as names, contact details, and potentially financial data. University officials discovered the intrusion after observing suspicious activity and promptly initiated an investigation. Law enforcement and cybersecurity specialists were engaged to contain the incident, assess affected systems, and notify those impacted. This breach highlights the persistent risks that higher education institutions face from increasingly sophisticated cyberattacks, especially targeting sensitive donor and alumni databases. As ransomware and data exfiltration trends intensify, universities must enhance defenses and closely align with compliance frameworks to mitigate regulatory, reputational, and operational risks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports