Universities, schools and research institutions — soft perimeters, valuable research, and frequent extortion victims.
Deterministic keyword + taxonomy matches over the live threat graph — a daily sweep, not analyst attribution. Zero LLM. Last rebuilt 2026-10-16.
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Graph links |
|---|---|---|
| Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 478 |
| LAPSUS$ | [LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion opera… | 351 |
| APT29 | [APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021)… | 305 |
| Star Blizzard | [Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely w… | 251 |
| DarkHydrus | [DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloa… | 250 |
| Turla | [Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range … | 231 |
| Earth Lusca | [Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Austral… | 213 |
| APT39 | [APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2… | 200 |
| APT41 | [APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 196 |
| Silent Librarian | [Silent Librarian](https://attack.mitre.org/groups/G0122) is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Libra… | 181 |
| HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets e… | 175 |
| MirrorFace | [MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools,… | 167 |
| Tonto Team | [Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 164 |
| Magic Hound | [Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted … | 162 |
| Aoqin Dragon | [Aoqin Dragon](https://attack.mitre.org/groups/G1007) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has primarily targeted government, edu… | 148 |
Campaigns and intel pulses mentioning this sector, most recent first.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| SharePoint ToolShell Exploitation | The [SharePoint ToolShell Exploitation](https://attack.mitre.org/campaigns/C0058) campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code exe… | — | — |
| C0021 | [C0021](https://attack.mitre.org/campaigns/C0021) was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporat… | — | — |
| ShadowRay | [ShadowRay](https://attack.mitre.org/campaigns/C0045) was a campaign that began in late 2023 targeting the education, cryptocurrency, biopharma, and other sectors through a vulnerability (CVE-2023-48022) in the Ray AI framework named Shadow… | — | — |
| C0011 | [C0011](https://attack.mitre.org/campaigns/C0011) was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/groups/G0134) that targeted students at universities and colleges in India. Security resear… | Transparent Tribe | — |
| Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF | A likely Russian-speaking malicious cyber actor leveraged artificial intelligence to orchestrate a global campaign exploiting PaperCut NG/MF print management software via CVE-2026-81578 and CVE-2026-82078. Using AI agents powered by DeepSee… | — | 2026-10-09 |
| US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide | The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolin… | — | 2026-10-09 |
| Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia | A Chinese-speaking threat operator deployed an AI orchestration framework called SecFlow to conduct intrusions across Taiwan, Indonesia, China, Vietnam, and Afghanistan. The campaign utilized commercial AI models (Claude, Qwen, DeepSeek) as… | — | 2026-10-03 |
| Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon | A Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign against Brazilian organizations since mid-2025, primarily targeting government and educational institutions. The attackers compromise web servers … | — | 2026-10-02 |
| Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles | In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent ben… | — | 2026-10-02 |
| Warlock Ransomware Attackers Hit Water and Telecom Operators | The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizati… | — | 2026-10-02 |
| Counterfeit installers to system compromise: Tracking a deceptive software download campaign | A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users… | — | 2026-10-02 |
| PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF affecting a customer in the Education sector. The attackers targeted an internet-facing print server running vulnerable PaperCut MF version 24.0.2, depl… | — | 2026-10-01 |
| NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activ… | — | 2026-09-29 |
| ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and governme… | — | 2026-09-28 |
| A fake resume invoked China's defence-tech elite, then installed VShell | A Chinese-language executable disguised as a resume claiming to be from a Beijing Institute of Technology graduate student delivers SNOWLIGHT and VShell RAT. The infection chain uses a custom Go loader with sandbox detection, CPU checks, an… | — | 2026-09-27 |
Techniques used by the actors above — what to detect for, ranked by how many of them use it.
| Technique | ATT&CK | Used by | Actors |
|---|---|---|---|
| Tool | T1588.002 | Earth Lusca, Turla, Aoqin Dragon | 17 |
| Malicious File | T1204.002 | Earth Lusca, Aoqin Dragon, Magic Hound | 12 |
| PowerShell | T1059.001 | Earth Lusca, Turla, Magic Hound | 12 |
| Ingress Tool Transfer | T1105 | Turla, Magic Hound, APT29 | 11 |
| Archive via Utility | T1560.001 | Earth Lusca, Turla, Magic Hound | 10 |
| Data from Local System | T1005 | Turla, Magic Hound, APT29 | 10 |
| Exploit Public-Facing Application | T1190 | Earth Lusca, Magic Hound, APT29 | 10 |
| Spearphishing Attachment | T1566.001 | APT29, APT39, Kimsuky | 10 |
| File Deletion | T1070.004 | Magic Hound, APT29, APT39 | 9 |
| File and Directory Discovery | T1083 | Turla, Aoqin Dragon, Magic Hound | 9 |
| Match Legitimate Resource Name or Location | T1036.005 | Earth Lusca, Turla, Magic Hound | 9 |
| System Network Configuration Discovery | T1016 | Earth Lusca, Turla, Magic Hound | 9 |
| Web Protocols | T1071.001 | Turla, Magic Hound, HAFNIUM | 9 |
| Windows Command Shell | T1059.003 | Turla, Magic Hound, HAFNIUM | 9 |
| Remote System Discovery | T1018 | Earth Lusca, Turla, Magic Hound | 8 |
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-52806 | 9.9 | # Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge ## Summary Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted bra… | |
| CVE-2026-35039 | 9.1 | _NOTE_: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users ar… | |
| CVE-2026-62371 | 8.8 | ## Impact The KubeEdge NodeUpgradeJob handler constructed the `keadm upgrade edge` command by concatenating the user-controlled `spec.version` and `spec.image` fields into a shell command. An authenticated user with pe… | |
| CVE-2026-62182 | 8.8 | ## Description KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes. The `updateFields` values from a ConfigUpdateJob were concatenated into a command string and executed through a syst… | |
| CVE-2025-10438 | 8.6 | Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog… | |
| CVE-2025-60239 | 8.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Injection.This issue affects CoSchool LMS: from n/a through <= 1… | |
| CVE-2026-18642 | 7.8 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.… | |
| CVE-2025-14249 | 7.3 | A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The manipulation of the argument product_id results in sql inject… | |
| CVE-2025-14209 | 7.3 | A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulation of the argument stud_id causes sql injection. The attack ca… | |
| CVE-2025-15198 | 7.3 | A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executing a manipulation of the argument User can lead to sql injecti… | |
| CVE-2025-11659 | 7.3 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This m… | |
| CVE-2025-11660 | 7.3 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. … | |
| CVE-2025-11661 | 7.3 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attac… | |
| CVE-2025-12277 | 7.3 | A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql … | |
| CVE-2025-11658 | 7.3 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of the file /assets/changeSllyabus.php. The manipulation of the… |
Named leak-site victims classified into this sector (ransomware.live taxonomy), most recent first.
| Victim | Crew | Discovered |
|---|---|---|
| S*o**n* Public Schools | nightspire | 2026-10-15 |
| Amity University Dubai | blacknevas | 2026-10-15 |
| Joliet Public Schools District 86 | qilin | 2026-10-14 |
| Spo****** Public Schools | nightspire | 2026-10-12 |
| Canadian Mennonite University (CMU) | dragonforce | 2026-10-12 |
| Friendship Christian School | qilin | 2026-10-11 |
| Helwan University (HITU) | UmBra | 2026-10-10 |
| Santee School District Foundation | thegentlemen | 2026-10-09 |
| University of Buraimi | thegentlemen | 2026-10-09 |
| Ansonia Public Schools | thegentlemen | 2026-10-09 |
| All Souls St Gabriels School | thegentlemen | 2026-10-09 |
| Northwestern Polytechnic | thegentlemen | 2026-10-09 |
| Shalom Christian Academy | interlock | 2026-10-09 |
| The Bernard Osher Foundation | nightspire | 2026-10-09 |
| Manipal Academy of Higher Edu | UmBra | 2026-10-08 |
Get a daily email when something new touches education — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.