✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Primary/Secondary Education
Breach intelligence, attack campaigns, and threat reports targeting the Primary/Secondary Education sector.
Explore Other Sectors
Primary/Secondary Education Threat Reports
UK Man Sentenced for Exploiting Minors via 'The Com' Network
In August 2026, 20-year-old Justin Swaddle from the United Kingdom was sentenced to two years in prison after pleading guilty to child sexual abuse offenses and blackmail. Operating under aliases such as 'Epstein,' 'Rugen,' and 'Moscow,' Swaddle was a member of 'The Com,' a decentralized cybercriminal network. He exploited social media platforms like Snapchat, Telegram, and Discord to target 117 female victims aged 13 to 17 across multiple countries, coercing them into providing explicit content under threat of exposing their personal information. ([en.wikipedia.org](https://en.wikipedia.org/wiki/The_Com?utm_source=openai)) This case underscores the evolving threat posed by 'The Com,' which has expanded from cybercrimes like SIM swapping and data breaches to more severe offenses, including sextortion and violence. The network's recruitment of minors and its use of sophisticated online platforms highlight the urgent need for enhanced cybersecurity measures and public awareness to protect vulnerable individuals from such exploitation. ([fbi.gov](https://www.fbi.gov/investigate/cyber/alerts/2025/hacker-com-cyber-criminal-subset-of-the-community-is-a-rising-threat-to-youth-online?utm_source=openai))
7 hours ago
Kill Chain
Fake Roblox Xeno Script Launcher Distributes Infostealer and RAT Malware
In early 2026, a malicious campaign targeted Roblox players by distributing fake Xeno Executor installers, a popular tool for running scripts on the platform. Attackers promoted these counterfeit installers through gaming forums and Discord communities, enticing users with promises of an 'undetected' version to bypass Roblox's anti-cheat mechanisms. Upon execution, the fake installer deployed a multi-stage malware payload, culminating in a Java-based Remote Access Trojan (RAT) and information stealer. This malware exfiltrated browser data, targeted online accounts and payment information, accessed cryptocurrency wallets, and provided surveillance capabilities, including keylogging and webcam access. The campaign's sophistication and the malware's extensive capabilities underscore the evolving threats in the gaming community. This incident highlights a growing trend of cybercriminals exploiting popular gaming platforms to distribute advanced malware. The use of trusted community channels for dissemination and the malware's ability to perform comprehensive data theft and remote control operations reflect a significant escalation in threat actor tactics. As gaming platforms continue to attract large user bases, they become increasingly lucrative targets for such sophisticated attacks.
6 days ago
Kill Chain
Surge in Cyberattacks on Brazilian Educational Institutions: A 2025-2026 Analysis
Between January 2025 and June 2026, Brazilian educational institutions experienced a significant rise in cyberattacks, predominantly ransomware incidents targeting both public and private entities. Notably, the DragonForce ransomware group claimed responsibility for an attack on Fundação Getulio Vargas in March 2026, threatening to release sensitive data unless their demands were met. Additionally, vulnerabilities like CVE-2025-8366 in the Portabilis i-Educar system exposed institutions to cross-site scripting attacks, compromising user data. These breaches led to operational disruptions, data encryption, and potential data exfiltration, highlighting the sector's vulnerability to cyber threats. ([dexpose.io](https://www.dexpose.io/dragonforce-ransomware-attack-targets-fundacao-getulio-vargas/?utm_source=openai)) The increasing frequency and sophistication of these attacks underscore the urgent need for enhanced cybersecurity measures within the education sector. With educational institutions holding vast amounts of sensitive data and often lacking robust security infrastructures, they have become prime targets for cybercriminals. This trend necessitates immediate action to bolster defenses, implement comprehensive incident response plans, and ensure compliance with data protection regulations to safeguard against future threats.
6 days ago
Kill Chain
Europol's Crackdown on 'The Com' Network: 4,340 URLs Flagged for Removal
Between June and July 2026, Europol coordinated 'Referral Action Days' involving investigators from nine countries to target 'The Com,' a decentralized network of nihilistic violent extremist groups. This operation led to the identification and referral of 4,340 URLs containing content that promotes self-harm, child sexual exploitation, and violent attacks. The initiative aimed to disrupt The Com's online ecosystem and limit the dissemination of extremist propaganda. This crackdown underscores the persistent threat posed by decentralized extremist networks exploiting online platforms to radicalize and victimize individuals, particularly minors. The operation highlights the necessity for continuous international collaboration to monitor and mitigate the spread of such harmful content.
2 weeks ago
Kill Chain
Lucide Proxy Campaign: A New Wave of Supply Chain Attacks
In May 2026, a campaign involving 148 malicious npm packages, disguised as student web proxies, covertly transformed users' browsers into nodes of a distributed denial-of-service (DDoS) botnet. These packages, branded as 'Lucide' and presented as tutoring services like 'Riverbend Tutoring' and 'Northstar Tutoring,' lured students seeking to bypass school web filters. Upon visiting these proxy sites, users' browsers loaded remote JavaScript payloads that executed DDoS attacks and injected aggressive popunder advertisements. The campaign exploited the npm ecosystem to distribute these packages, leveraging the browsers of end-users for malicious activities without their knowledge. ([research.jfrog.com](https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign/?utm_source=openai)) This incident underscores a significant evolution in supply chain threats, highlighting the vulnerability of end-user systems to malicious code distributed through trusted platforms. The attackers' use of mutable remote loaders and rapid iteration of package versions indicates a low operational security posture, focusing on maximizing short-term impact. Organizations must remain vigilant against such deceptive tactics, emphasizing the importance of scrutinizing third-party packages and educating users about the risks associated with untrusted proxy tools.
3 weeks ago
Kill Chain
Armenian National Pleads Guilty to Ryuk Ransomware Attacks
In July 2026, Armenian national Karen Serobovich Vardanyan pleaded guilty to charges of conspiracy and computer fraud for his involvement in deploying Ryuk ransomware against multiple U.S. organizations between November 2019 and April 2020. Operating from Ukraine and Russia, Vardanyan and his co-conspirators infiltrated the networks of a Michigan-based company, an Oregon technology firm, and a Texas school, encrypting critical data and demanding ransom payments in Bitcoin. The Michigan company paid nearly $1.2 million to regain access to its systems. Vardanyan faces up to 15 years in prison and has agreed to pay restitution of approximately $1.2 million. ([justice.gov](https://www.justice.gov/usao-or/pr/armenian-national-extradited-united-states-pleads-guilty-ransomware-extortion-conspiracy?utm_source=openai)) This case underscores the persistent threat posed by sophisticated ransomware operations like Ryuk, which have targeted various sectors, including healthcare, education, and critical infrastructure. The successful extradition and prosecution of Vardanyan highlight the importance of international cooperation in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against evolving ransomware tactics.
1 month ago
Kill Chain
ShinyHunters' Breach of Instructure's Canvas Platform Highlights Third-Party Risks in Education
In May 2026, the cybercriminal group ShinyHunters breached Instructure, the company behind the widely used learning management system Canvas, affecting numerous educational institutions. The attackers demanded a ransom, threatening to leak sensitive data if unpaid. This incident underscores the vulnerability of the education sector to third-party breaches, given its reliance on external vendors for critical services. ([insidehighered.com](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor?utm_source=openai)) The breach highlights the urgent need for educational institutions to enhance their third-party risk management strategies. As cyber threats targeting third-party vendors increase, schools must implement robust security measures and establish comprehensive incident response plans to mitigate potential damages.
1 month ago
Kill Chain
Instructure's Canvas LMS Breached Twice by ShinyHunters in 2026
In early May 2026, Instructure's Canvas learning management system (LMS) suffered two significant cyberattacks orchestrated by the ShinyHunters group. The initial breach on April 29 led to the exfiltration of personal data from approximately 275 million users across nearly 9,000 educational institutions. Compromised information included names, email addresses, student ID numbers, and private messages. Despite Instructure's remediation efforts, ShinyHunters executed a second attack on May 7, defacing Canvas login pages to pressure the company into paying a ransom. In response, Instructure reached an agreement with the attackers, resulting in the return and purported destruction of the stolen data. ([techcrunch.com](https://techcrunch.com/2026/05/12/instructure-strikes-deal-with-hackers-who-breached-it-twice/?utm_source=openai)) This incident underscores a growing trend where cybercriminals target educational technology vendors to exploit vulnerabilities and access vast amounts of sensitive data. The attacks on Instructure highlight the critical need for robust cybersecurity measures within the edtech sector to protect against such large-scale breaches.
1 month ago
Kill Chain
ShinyHunters Breach Infinite Campus: 137,000 School Staff Accounts Exposed
In March 2026, the ShinyHunters extortion group infiltrated Infinite Campus's Salesforce instance, compromising personal information of over 137,000 school staff members. The stolen data included names, email addresses, phone numbers, physical addresses, and support tickets. Infinite Campus, a leading EdTech provider serving over 3,200 school districts across the United States, confirmed the breach but stated that the majority of the exposed information was publicly available directory data. This incident underscores the escalating trend of cybercriminals targeting educational institutions and their service providers. The breach highlights the critical need for robust security measures and vigilant monitoring of third-party platforms to safeguard sensitive information in the education sector.
1 month ago
Kill Chain
Former IT Employee Sentenced for Prolonged Cyberattacks on School District
In June 2026, Ezekiel Dean Potter, a former senior IT support specialist at Saydel Community School District in Des Moines, Iowa, was sentenced to 21 months in prison for conducting a series of unauthorized cyberattacks against his former employer. After his termination in April 2023, Potter retained access credentials and over the next 21 months, he deleted the district's Facebook page, disrupted access to educational platforms, and reset employee usernames and passwords, causing significant operational disruptions and financial losses estimated at tens of thousands of dollars. This incident underscores the critical importance of promptly revoking access credentials of departing employees and implementing robust monitoring systems to detect unauthorized access. The case highlights the potential risks posed by insider threats and the necessity for organizations to enforce strict access control policies to safeguard their digital assets.
1 month ago
Kill Chain
French Government's Tchap Messaging Service Compromised in Account Hijacking Incident
In June 2026, the French government's encrypted messaging platform, Tchap, suffered a security breach due to the hijacking of a legitimate user account. The attacker accessed public chat rooms, which are not end-to-end encrypted, and exfiltrated over 643,000 messages and more than 59,000 media files from approximately 73,000 public servants. The compromised account was promptly identified and blocked to prevent further unauthorized access. This incident underscores the critical importance of securing user accounts and the potential risks associated with unencrypted public communication channels. Organizations must reassess their security protocols to ensure that sensitive information is adequately protected, even in public forums.
2 months ago
Kill Chain
WeedHack Malware Campaign Compromises Over 116,000 Minecraft Systems
In early 2026, a large-scale malware campaign named WeedHack targeted Minecraft players, infecting over 116,000 systems by June. The malware was disseminated through malicious Minecraft mods, clients, cheats, and utilities promoted via YouTube videos and SEO poisoning techniques. Once installed, WeedHack functioned as a malware-as-a-service (MaaS) infostealer, providing attackers with dashboards to view stolen credentials and system information. The campaign averaged between 2,000 and 3,000 new infections daily, with most victims located in the United States, Germany, India, and the UK. ([mcafee.com](https://www.mcafee.com/blogs/security-news/minecraft-malware-campaign-research-teen-hacker-cyberbullying/?utm_source=openai)) This incident underscores the evolving threat landscape where cybercriminals exploit popular gaming platforms to distribute malware. The accessibility of WeedHack's MaaS model, with free and low-cost premium tiers, has lowered the barrier for entry, enabling even inexperienced individuals to launch attacks. The campaign's success highlights the need for heightened vigilance and robust security measures within the gaming community. ([mcafee.com](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/weedhack-minecraft-malware-as-a-service-campaign-research/?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports