The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
PaperCut Vulnerabilities Exploited in Massive Credential Theft Campaign Against Schools
In September 2026, threat actors actively exploited two chained PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) to conduct widespread credential theft attacks against educational institutions across the United States and Europe. The attack chain leveraged an authentication bypass vulnerability followed by remote code execution to deploy registry harvesting tools, Metasploit payloads, and create privileged accounts on compromised print management servers. Arctic Wolf researchers observed attackers systematically extracting Windows registry hives, searching configuration files for sensitive credentials, and establishing persistent access through Meterpreter sessions, targeting organizations from K-12 schools to major universities. This campaign highlights the continued targeting of educational infrastructure, which often lacks robust security controls and runs legacy systems with delayed patching cycles, making institutions particularly vulnerable to supply chain and third-party application exploits.
2 weeks ago
Kill Chain
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
In 2026, artificial intelligence is fundamentally transforming the cybercrime landscape by dramatically compressing attack timelines and lowering entry barriers for threat actors. Former cybercriminal Brett Johnson, known as the 'original Internet Godfather' by the US Secret Service, demonstrated at Black Hat USA how AI enables attackers to conduct reconnaissance, identify crown jewels, and execute attacks in significantly reduced timeframes. While defenders still operate reactively, AI empowers criminals to automate target research, vulnerability discovery, and even ransomware development without requiring advanced technical skills. This shift is driving more attackers toward critical infrastructure targets like hospitals and schools, where higher payouts justify the risks. The technology's learning-based nature means it benefits attackers more than defenders, as it must observe successful attacks to improve, creating an inherent advantage for malicious actors in the current threat landscape.
3 weeks ago
Kill Chain
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
In December 2025 through January 2026, NSO Group's Pegasus spyware infected the iPhone of a Serbian student protest movement member using a zero-click iMessage exploit. The attack was part of a broader surveillance campaign targeting at least 14 Serbian activists, opposition politicians, and student leaders coinciding with March 2026 local elections. Citizen Lab and SHARE Foundation confirmed the infection, while a separate incident involved NoviSpy Android malware deployed during police detention of another student activist. This incident highlights the escalating use of commercial spyware against civil society, particularly as authoritarian governments increasingly weaponize surveillance technology to suppress political dissent and monitor opposition movements ahead of critical elections.
3 weeks ago
Kill Chain
Global RMM Phishing Campaign Exploits Legitimate Cloud Services Across 46 Countries
In September 2026, security researchers identified a sophisticated RMM phishing campaign spanning 46 countries, with the United States accounting for 45% of observed activity. The operation used fake documents mimicking tax forms, shipping notifications, and government communications to trick victims into installing legitimate remote monitoring and management software. Attackers leveraged rapidly rotating infrastructure on Vercel, GitHub Pages, and Netlify, with 94% of 425 identified URLs observed for only a single day. The campaign targeted education, technology, government, banking, and manufacturing sectors. This incident highlights the growing trend of threat actors abusing legitimate cloud services and software for malicious purposes, making detection increasingly challenging through traditional IOC-based approaches.
3 weeks ago
Kill Chain
Historic Federal Detention: Maine Teen First Minor Charged in 764 Extremist Case
In December 2024, a 17-year-old from Maine became the first minor to be federally charged and detained for crimes related to involvement in 764, a nihilistic violent extremist collective. The teenager was convicted of multiple federal crimes including conspiracy to sexually exploit children, distributing child sexual abuse material, cyberstalking, and identity theft. This case represents a significant shift in federal law enforcement policy, as authorities have historically avoided prosecuting minors for extremist activities, creating what experts called a dangerous loophole that encouraged maximum harm before age 18. This prosecution signals law enforcement's evolved approach to addressing violent online extremism that increasingly targets and recruits minors. With the FBI investigating over 500 subjects nationwide connected to 764 and affiliated groups, this case establishes precedent for holding juvenile perpetrators accountable while disrupting recruitment strategies that exploit legal protections for minors.
3 weeks ago
Kill Chain
Silver Fox's Sophisticated Software Supply Chain Attack Disables Windows Security
In September 2026, Microsoft detected an active malware campaign by the Chinese threat group Silver Fox (Yinhu) targeting multinational organizations with operations in China. The attackers created high-fidelity counterfeit software download websites impersonating trusted vendors like Microsoft Edge, Kaspersky, and Baidu to distribute malicious installers. Once executed, these installers deployed ValleyRAT malware that established persistence, disabled Windows Update services, weakened Microsoft Defender protections, and communicated with command-and-control infrastructure on non-standard ports. The campaign affected multiple sectors including healthcare, manufacturing, gaming, technology, logistics, government, and education. This incident highlights the evolving sophistication of supply chain attacks and social engineering tactics, particularly as organizations increasingly rely on third-party software downloads. The campaign demonstrates how threat actors are adapting to security improvements by targeting the software acquisition process itself, making detection more challenging.
3 weeks ago
Kill Chain
Chinese Cybercriminals Turn Brazilian Government Sites into Gambling Traffic Redirectors
The Chinese-speaking Gambling Goblin cybercrime cluster has been compromising Brazilian government and educational web servers since mid-2025, installing malicious Apache modules to redirect visitors to attacker-controlled gambling and sports betting pages. The campaign leverages compromised high-reputation .gov.br domains to manipulate search engine optimization at scale, with modules reverse-proxying traffic while stripping security headers to allow malicious content execution. Linked to the Earth Berberoka threat group, the operation deploys sophisticated tooling including custom downloaders, modular backdoors, and credential stealers to maintain persistent access to government infrastructure. This incident highlights the growing trend of SEO manipulation attacks targeting government domains for cybercriminal profit, particularly as Brazil's newly regulated online betting market creates lucrative opportunities for threat actors to exploit trusted infrastructure for financial gain.
3 weeks ago
Kill Chain
Silver Fox Supply Chain Attack: How Counterfeit Software Sites Compromise Enterprise Networks
Microsoft Defender Experts has identified an active malware campaign using counterfeit software download websites to distribute malicious installers targeting organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The campaign primarily affects China-based operations and Chinese-speaking users through high-fidelity clones of legitimate vendor sites offering popular software downloads. Once executed, the malicious installers deploy persistent malware that weakens security protections, establishes command and control connections, and enables potential data exfiltration through encrypted channels. This incident highlights the growing sophistication of supply chain attacks targeting software distribution channels, coinciding with increased regulatory focus on software supply chain security and the rise of AI-powered security evasion techniques.
3 weeks ago
Kill Chain
Leaked Russian Documents Expose Systematic Cyber Warfare Training Pipeline
In September 2026, leaked training materials from Russia's Bauman Moscow State Technical University exposed the institutional framework behind Russian state-sponsored cyber operations. The documents revealed Department No. 4's role as a pipeline for recruiting students into GRU units including Sandworm (Military Unit 74455) and APT28, showing formalized pathways from university recruitment to military cyber roles. The leak provided unprecedented insight into how Russia systematically develops cyber capabilities through supervised technical and ideological preparation of students before their assignment to intelligence and cyber warfare units. This exposure comes as Russian cyber operations have intensified against critical infrastructure globally, with increased focus on destructive attacks and espionage campaigns targeting government and private sector networks across multiple domains.
3 weeks ago
Kill Chain
Serbian Activists Targeted in Largest Documented Pegasus and NoviSpy Spyware Campaign
In early 2026, researchers discovered the first confirmed Pegasus spyware infection of the year alongside NoviSpy variant infections targeting 14 Serbian individuals, including student activists, a parliament member, and local government official. The SHARE Foundation documented this as the largest wave of surveillance in Serbia to date, coinciding with local elections and student protests following the 2024 Novi Sad railway station collapse. Pegasus infections utilized zero-click exploits from December 2025 to January 2026, while NoviSpy variants were deployed during police detention and questioning of activists. This incident highlights the continued weaponization of commercial spyware against civil society and democratic movements, demonstrating how state-sponsored surveillance capabilities are increasingly deployed to suppress political dissent and monitor opposition activities during critical electoral periods.
3 weeks ago
Kill Chain
PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector
Two critical zero-day vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were actively exploited by threat actors in August 2026 for data theft attacks. The flaws can be chained to bypass authentication and achieve remote code execution on vulnerable servers used by over 100 million users across 70,000 organizations globally. PaperCut Software released three emergency patches within a week to address the vulnerabilities, but threat intelligence indicates attackers are exploiting these flaws to dump database tables and steal sensitive data from exposed servers. With over 800 PaperCut servers still exposed online and a history of ransomware groups targeting similar vulnerabilities, this incident highlights the critical risk posed by internet-facing print management infrastructure. This incident underscores the growing trend of attackers targeting enterprise software zero-days for immediate data theft rather than prolonged persistence, reflecting the increasing sophistication and speed of modern threat actors in monetizing newly discovered vulnerabilities.
3 weeks ago
Kill Chain
McKesson's $55M Data Extortion: How ShinyHunters Exploited Healthcare's Cloud Vulnerabilities
In August 2024, McKesson Corporation, a major healthcare distributor handling one-third of North America's pharmaceuticals with $403.4 billion in revenue, suffered a sophisticated data extortion attack by the ShinyHunters cybercrime group. The attackers gained access to third-party applications between August 21-25, stealing sensitive data from oncology, multispecialty, and medical-surgical business units. ShinyHunters demanded over $55 million in ransom and threatened to leak stolen data by September 1, 2024, demonstrating their typical social engineering tactics to exploit identity and access management weaknesses in cloud-hosted environments. This incident highlights the escalating threat of data extortion campaigns targeting critical healthcare infrastructure, as ShinyHunters continues their spree of high-profile attacks against cloud platforms including Oracle, Salesforce, and Snowflake, exploiting valid credentials to evade traditional security controls.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports