Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Higher Education/Acadamia

Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.

490 threat reports
Page 39 of 41
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Higher Education/Acadamia Threat Reports

Showing 457–468 / 490 reports
How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware
Government Administration10 months ago

How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware

In early 2024, cybersecurity researchers at Kaspersky uncovered an advanced malware campaign, codenamed 'Operation ForumTroll,' targeting Russian government entities, media outlets, financial institutions, and research organizations. The campaign was linked to Memento Labs, the successor to the notorious Italian surveillance company Hacking Team. Leveraging a zero-day vulnerability in Google Chrome, attackers distributed personalized phishing emails which, when clicked, led victims to malicious websites; no further interaction was required to infect devices. The campaign enabled espionage, data exfiltration, and surveillance with high sophistication, including the deployment of a new commercial spyware tool known as 'Dante.' This incident highlights the increasing commercialization and sophistication of spyware operations, the targeting of Russian organizations by state-aligned APTs, and the ongoing exploitation of zero-day vulnerabilities in popular software. It underscores the urgency for organizations to proactively monitor threat activity and patch systems swiftly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day
Government Administration10 months ago

Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day

In March 2025, Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign targeting Russian government agencies, critical institutions, and media organizations. The threat actors employed personalized spear-phishing emails carrying unique, short-lived links; merely visiting these sites using Chrome or Chromium-based browsers enabled a zero-day exploit (CVE-2025-2783) to escape the browser sandbox. The attackers established system persistence via COM hijacking, then operated stealthy malware—LeetAgent and the commercial Dante spyware, attributed to Memento Labs (formerly Hacking Team)—to exfiltrate sensitive files and credentials, while leveraging cloud infrastructure for their C2 communications and tool delivery. This campaign exemplifies a new wave of highly targeted, sophisticated APT activity leveraging commercial spyware and advanced zero-day exploitation. As browser vulnerabilities and commercial surveillance tools increasingly intersect, organizations must urgently review security for endpoints, threat detection, and privileged access to counter fast-evolving espionage operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses
Health Care / Life Sciences10 months ago

Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses

In early to mid-2025, the notorious Qilin ransomware group (also known as Agenda/Gold Feather/Water Galura) executed a wave of aggressive hybrid cyberattacks, combining Linux-targeting ransomware payloads with a sophisticated BYOVD (Bring Your Own Vulnerable Driver) exploit. The attacks leveraged unpatched vulnerabilities to gain initial access, followed by lateral movement across multi-cloud and on-premises environments. Once inside, Qilin deployed encryption routines across both Windows and Linux servers, exfiltrated sensitive business data, and posted victim details on its dark web leak site, with attack volumes peaking at over 100 cases in June 2025. Organizations across healthcare, finance, and manufacturing were among those affected, experiencing significant operational disruptions, data exposure risks, and costly recovery processes. The rise of cross-platform ransomware with BYOVD techniques demonstrates attackers' growing technical sophistication and ability to evade traditional defenses. As ransomware-as-a-service (RaaS) operations like Qilin accelerate, organizations face increasing regulatory scrutiny and must enhance cloud, endpoint, and network segmentation strategies to defend against such adaptive threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild
Government Administration10 months ago

Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild

In October 2025, Microsoft disclosed and urgently patched a critical remote code execution vulnerability (CVE-2025-59287) impacting the Windows Server Update Services (WSUS) framework. Following the public release of a proof-of-concept exploit, threat actors began actively targeting vulnerable WSUS deployments to execute malicious code, gain unauthorized access, and potentially compromise large segments of enterprise environments. The flaw, assigned a CVSS score of 9.8, allowed unauthenticated attackers to leverage exposed update services, posing significant risk to organizations’ patch management infrastructures before the emergency fix was implemented. This incident highlights the continuing trend of sophisticated adversaries exploiting zero-day and n-day vulnerabilities in widely used systems with available PoCs. It also underscores growing urgency for proactive patch management, real-time anomaly detection, and adoption of Zero Trust models to protect against rapidly weaponized threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
China-Linked ToolShell SharePoint Attacks Hit Four Continents in 2025
Government Administration10 months ago

China-Linked ToolShell SharePoint Attacks Hit Four Continents in 2025

In 2025, a coordinated cyber-espionage campaign attributed to Chinese-state actors targeted organizations across government, academic, telecommunications, and finance sectors by exploiting the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint. Attackers gained initial access through unpatched SharePoint deployments, enabling lateral movement, exfiltration of sensitive data, and persistent covert access. Victims spanned four continents, highlighting the campaign's scale and impact on critical information flows and business operations. The attackers' use of encrypted communications and sophisticated toolsets complicated detection and eradication efforts, leading to material operational and reputational risks for affected entities. This incident underscores a broader trend of supply chain and platform vulnerabilities being weaponized by advanced, nation-state groups. With the rapid disclosure of exploits and a proliferation of similar techniques, patch management and visibility into east-west traffic remain urgent enterprise priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach
Telecommunications10 months ago

Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach

In July 2025, Chinese state-affiliated threat actors exploited the recently patched ToolShell vulnerability in Microsoft SharePoint to breach a major telecommunications company in the Middle East. This advanced persistent threat (APT) group swiftly leveraged the disclosed flaw to gain unauthorized access, rapidly launching attacks just weeks after the patch was released. Their campaign extended to government bodies in Africa and South America, as well as academic and technology institutions in the US, highlighting a rapid weaponization of public vulnerabilities. The attackers used sophisticated techniques for lateral movement, data exfiltration, and persistence within the affected networks, likely resulting in compromise of sensitive communications, operational disruption, and potential regulatory exposure for the victims. This incident demonstrates how APT actors quickly adapt to disclosed vulnerabilities and underscores the urgency for organizations to accelerate patching cycles and bolster east-west security controls. The event marks an increasing trend of state-sponsored groups targeting hybrid cloud environments and critical infrastructure via freshly disclosed exploits.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Harvard University Breached by Clop Ransomware: Oracle Zero-Day Attack Exposes Data
Higher Education/Acadamia10 months ago

Harvard University Breached by Clop Ransomware: Oracle Zero-Day Attack Exposes Data

In the first half of 2024, Harvard University fell victim to a significant cyberattack orchestrated by the Clop ransomware group, exploiting a zero-day vulnerability in Oracle software. The threat actors gained unauthorized access to sensitive university data, exfiltrating large volumes as part of a broader campaign that targeted Oracle customers worldwide. The breach showcases how sophisticated ransomware groups leverage software supply chain weaknesses, often exploiting vulnerabilities before patches become available. As a result, Harvard faced disruption of operations, regulatory scrutiny, and potential exposure of sensitive academic and financial data. This incident underscores the escalating trend of ransomware operations exploiting zero-day flaws to target major institutions, particularly in the education sector. The attack highlights urgent needs for advanced segmentation, rapid patching, and proactive lateral movement prevention as ransomware groups become more aggressive and opportunistic.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Oracle E-Business Suite Hit by Critical Unauthenticated Data Exposure Vulnerability
Financial Services10 months ago

Oracle E-Business Suite Hit by Critical Unauthenticated Data Exposure Vulnerability

In October 2025, Oracle disclosed a high-severity vulnerability (CVE-2025-61884) affecting E-Business Suite versions 12.2.3 through 12.2.14. This flaw allows unauthenticated attackers to access sensitive data without login, leveraging a network-exploitable bug rated CVSS 7.5. Organizations running impacted Oracle EBS versions are at risk of data compromise, business disruption, and regulatory exposure if left unpatched. Oracle issued a security alert and urgent patch to address the issue as exploitation attempts in the wild are anticipated. This disclosure underscores the growing trend of unauthenticated, remote data access flaws targeting ERP platforms. Critical business applications present attractive targets for threat actors, especially as organizations expand interconnectivity. Prompt detection and segmentation of east-west traffic remain essential as ERP vulnerabilities increasingly underpin large-scale, compliance-relevant breaches.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Clop Breaches Envoy Air via Oracle EBS Zero-Day in 2025: Key Lessons in Ransomware Defense
Airlines/Aviation10 months ago

Clop Breaches Envoy Air via Oracle EBS Zero-Day in 2025: Key Lessons in Ransomware Defense

In October 2025, Envoy Air, a regional subsidiary of American Airlines, confirmed that attackers compromised business information from its Oracle E-Business Suite (EBS) application. The Clop ransomware/extortion group exploited a newly discovered Oracle EBS zero-day (CVE-2025-61882) to access internal systems in August 2025. Upon discovery, Envoy initiated an investigation, notifying law enforcement and confirming that no sensitive customer or employee data was affected, though limited business and commercial contact details were exposed. This incident underscores the rising trend of ransomware and extortion groups leveraging zero-day vulnerabilities in key enterprise platforms. The Clop gang continues to target multiple industries through advanced attacks on widely used software, emphasizing the urgent need for robust patch management, east-west traffic security, and zero trust segmentation strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Viral TikTok Malware Campaign Bypasses Security via Social Engineering and Infostealer
Computer Software/Engineering10 months ago

Viral TikTok Malware Campaign Bypasses Security via Social Engineering and Infostealer

In October 2024, cyber attackers launched a widespread malware campaign on TikTok, leveraging viral videos that promised free software activations—such as Photoshop—to lure unsuspecting users. Victims were instructed to execute malicious PowerShell scripts, leading to the silent download of infostealers like AuroStealer and additional payloads that achieved persistence and utilized advanced in-memory code execution techniques. The highly effective social engineering exploited TikTok’s reach, spreading through multiple videos and targeting users seeking pirated software, resulting in significant risks of credential theft and further compromise. This attack exemplifies the growing trend of financially motivated threat actors exploiting popular social platforms for initial access. The use of self-compiling malware and in-memory shellcode injection reflects advanced tactics that bypass traditional security controls, highlighting the urgent need for robust endpoint protection, increased security awareness, and stricter monitoring of social media for malicious content.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Adobe AEM Forms Zero-Day (CVE-2025-54253) Actively Exploited for Remote Code Execution
Government Administration10 months ago

Adobe AEM Forms Zero-Day (CVE-2025-54253) Actively Exploited for Remote Code Execution

In October 2025, a maximum-severity vulnerability (CVE-2025-54253) in Adobe Experience Manager (AEM) Forms was discovered to be actively exploited in the wild. The flaw, allowing unauthenticated remote code execution via authentication bypass, affected AEM Forms on JEE versions 6.5.23 and earlier. Researchers from Searchlight Cyber originally reported the issue in April, but public exploit code and detailed writeups emerged before Adobe issued a patch in August. Attackers were able to exploit the misconfiguration to gain complete control over unpatched systems, endangering both public and private sector organizations. This incident underscores the increasing threat posed by delayed patching and public disclosure of unpatched zero-days. It highlights the importance of rapid vulnerability management, particularly for federal agencies under BOD 22-01, and serves as a warning for organizations to prioritize patching high-impact application flaws to protect critical business operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Microsoft Disrupts 2025 Ransomware Campaign Using Fake Teams Installers
Higher Education/Acadamia10 months ago

Microsoft Disrupts 2025 Ransomware Campaign Using Fake Teams Installers

In October 2025, Microsoft successfully disrupted a ransomware campaign orchestrated by the threat group Vanilla Tempest (also known as Vice Society/VICE SPIDER) targeting Microsoft Teams users. Attackers used malvertising and SEO poisoning to promote websites impersonating the official Teams download page, tricking users into downloading malicious installers. These fake installers delivered the Oyster backdoor, granting attackers remote access for data theft, command execution, and the deployment of Rhysida ransomware. Microsoft responded by revoking over 200 abused code-signing certificates used to legitimize the malicious payloads, effectively hampering the campaign. This attack underscores the growing risk of supply chain compromise via trusted application installers and increasingly sophisticated social engineering techniques. The resurgence of ransomware-as-a-service operators leveraging signed malware highlights the urgent need for identity-driven defenses, vigilant certificate monitoring, and robust endpoint security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports