Education threat landscape
Universities, schools and research institutions — soft perimeters, valuable research, and frequent extortion victims.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 19
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 110
- Ransomware victims, since 2026-06
- 142
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 19.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| Kimsuky | Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 485 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| APT29 | APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).… | 311 |
| Star Blizzard | Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely w… | 262 |
| Turla | Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range… | 246 |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 210 |
| APT39 | APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2… | 205 |
| Silent Librarian | Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of [Silent Libra… | 187 |
| MirrorFace | MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools,… | 181 |
| HAFNIUM | HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets e… | 178 |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 168 |
| menuPass | menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Mi… | 153 |
| Aoqin Dragon | Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, edu… | 149 |
| INC Ransom | INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. [… | 82 |
| APT19 | APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal… | 80 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 49.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| C0011 | C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security resear… | Transparent Tribe | — |
| ShadowRay | ShadowRay was a campaign that began in late 2023 targeting the education, cryptocurrency, biopharma, and other sectors through a vulnerability (CVE-2023-48022) in the Ray AI framework named Shadow… | — | — |
| SharePoint ToolShell Exploitation | The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code exe… | — | — |
| How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage | Illegal online gambling infrastructure spans three distinct cybercrime categories that defenders often overlook. First, over 1.7 million Chinese-language casino domains facilitate illegal gambling and transnational money laundering, primari… | — | 2026-10-16 |
| US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide | The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolin… | — | 2026-10-09 |
| Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia | A Chinese-speaking threat operator deployed an AI orchestration framework called SecFlow to conduct intrusions across Taiwan, Indonesia, China, Vietnam, and Afghanistan. The campaign utilized commercial AI models (Claude, Qwen, DeepSeek) as… | — | 2026-10-03 |
| Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles | In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent ben… | — | 2026-10-02 |
| Warlock Ransomware Attackers Hit Water and Telecom Operators | The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizati… | — | 2026-10-02 |
| Counterfeit installers to system compromise: Tracking a deceptive software download campaign | A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users… | — | 2026-10-02 |
| PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578 | On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF affecting a customer in the Education sector. The attackers targeted an internet-facing print server running vulnerable PaperCut MF version 24.0.2, depl… | — | 2026-10-01 |
| NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activ… | — | 2026-09-29 |
| ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and governme… | — | 2026-09-28 |
| A fake resume invoked China's defence-tech elite, then installed VShell | A Chinese-language executable disguised as a resume claiming to be from a Beijing Institute of Technology graduate student delivers SNOWLIGHT and VShell RAT. The infection chain uses a custom Go loader with sandbox detection, CPU checks, an… | — | 2026-09-27 |
| Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US | Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Man… | — | 2026-09-17 |
| Fake Software Installers Disable Windows Update and Weaken Microsoft Defender | An active malware campaign utilizes fraudulent software-download websites impersonating trusted vendors to distribute malicious installers. The operation primarily targets China-based operations of multinational organizations and Chinese-sp… | — | 2026-09-03 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 304.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-52806 | 9.9 | # Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge ## Summary Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted bra… | |
| CVE-2024-31026 | 9.8 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module.… | |
| CVE-2026-66483 | 9.8 | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.… | |
| CVE-2026-35039 | 9.1 | _NOTE_: While the library exposes a mechanism which could introduce the vulnerability, this issue is created by developer-supplied code and not by the library itself. We will add a warning and some education for users ar… | |
| CVE-2025-10438 | 8.6 | Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog… | |
| CVE-2026-18642 | 7.8 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.… | |
| CVE-2026-88065 | 7.5 | `tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/ap… | |
| CVE-2025-15198 | 7.3 | A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executing a manipulation of the argument User can lead to sql injecti… | |
| CVE-2025-11659 | 7.3 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This m… | |
| CVE-2026-102913 | 7.3 | A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection… | |
| CVE-2025-11658 | 7.3 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of the file /assets/changeSllyabus.php. The manipulation of the… | |
| CVE-2025-11660 | 7.3 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. … | |
| CVE-2025-11661 | 7.3 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attac… | |
| CVE-2025-14209 | 7.3 | A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulation of the argument stud_id causes sql injection. The attack ca… | |
| CVE-2025-11657 | 7.3 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unknown function of the file /assets/createNotice.php. The manipu… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Education), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Seminole Schools | Global Secret Group | 2026-10-19 |
| American Campus | Helix | 2026-10-19 |
| Llano Independent School District | qilin | 2026-10-18 |
| Wellington College International School Bangkok | thegentlemen | 2026-10-17 |
| Girl Scouts of Eastern Massachusetts | Wallstreet | 2026-10-16 |
| Saga University | thegentlemen | 2026-10-16 |
| St Peters Anglican Primary School | thegentlemen | 2026-10-16 |
| Universidade de Passo Fundo | thegentlemen | 2026-10-16 |
| nowaszkola.com | incransom | 2026-10-15 |
| S*o**n* Public Schools | nightspire | 2026-10-15 |
| Amity University Dubai | blacknevas | 2026-10-15 |
| Joliet Public Schools District 86 | qilin | 2026-10-14 |
| Spo****** Public Schools | nightspire | 2026-10-12 |
| Canadian Mennonite University (CMU) | dragonforce | 2026-10-12 |
| Friendship Christian School | qilin | 2026-10-11 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches education — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.