CYFIRMA Report Highlights Elevated Cyber Risks Facing the Education Sector
Summary
CYFIRMA’s report finds elevated education-sector cyber risks, including state-sponsored campaigns, credential theft, rising vulnerability disclosures and 85 ransomware victims in the latest 90-day period.
Key points
- Education organizations appeared in 12 of 114 observed campaign updates (11%). The report describes a narrow, state-sponsored actor set led by MISSION2074, with Lazarus Group second; operating systems ranked above web applications among targeted technologies.
- Of five reported incidents, credential theft featured in more than half. The report also describes a China-linked group exploiting a Roundcube flaw against academic researchers in the United States and Canada, and nine months of undetected access to South Korea’s diplomat training system.
- Education-sector ransomware victims rose 19.7%, from 71 to 85. Universities and research institutions accounted for almost half of the victims; Qilin and Thegentlemen led by volume but directed only about 3% of their activity at education.
- The report counted 448 education-linked vulnerability mentions, with total volume rising in each period. Remote and arbitrary code execution made up roughly three-quarters of final-period disclosures.
- Education organizations generated 2,134 underground and dark-web mentions. Chatter declined during the reporting window, while claimed hacks were the only category showing sustained growth.
- The report highlights supplier exposure, including Mathspace’s disclosed breach affecting more than one million people, and warns that compromised education domains can be used to host phishing sites targeting others.
- The findings draw on CYFIRMA platform telemetry and public reporting. The report notes that incident counts are a thin base and that ransomware victim data comes from group blogs, with possible gaps and classification discrepancies.
Article Details
- Publisher
- CYFIRMA
- Report Period
- 2026-07-01 to 2026-09-30
- Scope
- Global external threat landscape of the Education Industry, covering APT campaigns, reported incidents, underground chatter, vulnerabilities, and ransomware.
- Sample Size
- 114 campaign updates; 699 publicly reported incidents, 518 with an identified industry; more than 300,000 underground posts; 11,537 industry-linked vulnerability mentions; 2,761 ransomware victims.
- Key Statistics
- Education appeared in 12 of 114 observed campaign updates, or approximately 11%.
- Five of 518 incidents with an identified industry involved education, or 0.97%.
- Education accounted for 2,134 of 46,019 industry-linked underground mentions, or 4.64%.
- Education accounted for 448 of 11,537 industry-linked vulnerability mentions, or 3.88%; remote and arbitrary code execution represented roughly three-quarters of final-period volume.
- The report identified 85 education ransomware victims, up 19.7% from 71 in the previous quarter; its victim data is sourced from ransomware-group blogs.
Threat Actors
APT27Suspected China-linked actor represented in observed education campaigns.Cl0pRansomware group whose listed education victim activity was concentrated in September.CmdorganizationRansomware group with listed education victims only in July; the report says education represented 21.4% of its victims.DYSPHOR1ALow-volume ransomware group for which education represented 30.0% of listed victims.ExfilSquadRansomware group with listed education victims only in July.Gothic PandaSuspected China-linked actor represented in observed education campaigns.InterlockLow-volume ransomware group for which education represented 21.4% of listed victims.KrybitRansomware group whose listed education victims increased from one in July to three in September.Lazarus GroupNorth Korea-associated actor ranked second in observed education campaigns.MISSION2074Suspected China-linked actor with the highest observed education campaign count.OilRigIran-linked actor appearing in observed education campaigns.PanzerRansomware group whose listed education victim activity was concentrated in September.QilinRansomware group with 12 listed education victims during the reporting period.SafepayRansomware group with listed education victims only in July.ShinyHuntersClaimed the previous quarter's Instructure and Canvas compromise.Stone PandaSuspected China-linked actor represented in observed education campaigns.The GentlemenRansomware group with 10 listed education victims during the reporting period.WallstreetRansomware group whose listed education victim activity was concentrated in September.
Vendors
CYFIRMAThe CYFIRMA Industry Report delivers original cybersecurity insights and telemetry-driven statistics of global industries, covering one sector each week for a quarter.InstructureFive incidents, 11th of 14, a fall that measures the end of the Instructure and Canvas news cycle rather than reduced exposure.MathspaceMathspace disclosed a breach affecting over a million people, an education technology provider rather than a school, which is exactly the pattern that defined the Instructure incident and that research during the period
Products
Active DirectoryContent management systems, file hosting systems, Active Directory, Apache Log4j, Microsoft Windows, and remote desktop protocol each appear once.Apache Log4jContent management systems, file hosting systems, Active Directory, Apache Log4j, Microsoft Windows, and remote desktop protocol each appear once.CanvasFive incidents, 11th of 14, a fall that measures the end of the Instructure and Canvas news cycle rather than reduced exposure.DeCYFIRCYFIRMA delivers pre-emptive cybersecurity, cyber threat intelligence, and external threat landscape management through its platforms, DeCYFIR and DeTCT.DeTCTCYFIRMA delivers pre-emptive cybersecurity, cyber threat intelligence, and external threat landscape management through its platforms, DeCYFIR and DeTCT.Microsoft WindowsContent management systems, file hosting systems, Active Directory, Apache Log4j, Microsoft Windows, and remote desktop protocol each appear once.Oracle PeopleSoftThat cluster also carried the University of Nottingham breach and the Oracle PeopleSoft zero-day campaign that swept through higher education.RoundcubeA China-linked group exploited a Roundcube webmail flaw to spy on academic researchers in the United States and Canada.
Countries
AustraliaAustralia, Germany, India, Singapore, and Taiwan form an even second tier, each recording identical counts.BrazilGermany and Canada recorded the highest elevations in the last 90 days, rising by 6 and 5 victims, respectively, followed by Brazil, Colombia, Myanmar, and Romania.CanadaA China-linked group exploited a Roundcube webmail flaw to spy on academic researchers in the United States and Canada.ChinaObserved APT campaigns are led by suspected China-linked, state-sponsored actors, with MISSION2074 recording the highest campaign count.ColombiaGermany and Canada recorded the highest elevations in the last 90 days, rising by 6 and 5 victims, respectively, followed by Brazil, Colombia, Myanmar, and Romania.FranceEuropean presence is limited, covering Germany, Italy, the Netherlands, France, and the United Kingdom.GermanyAustralia, Germany, India, Singapore, and Taiwan form an even second tier, each recording identical counts.IndiaAustralia, Germany, India, Singapore, and Taiwan form an even second tier, each recording identical counts.IndonesiaSoutheast Asian representation includes Singapore, the Philippines, Thailand, Indonesia, Malaysia, and Vietnam.IranIran-linked OilRig also appears, alongside a single Chinese cybercriminal group.ItalyEuropean presence is limited, covering Germany, Italy, the Netherlands, France, and the United Kingdom.JapanVictim distribution spans 23 countries, with the United States recording the highest victim count, followed by Japan.MalaysiaSoutheast Asian representation includes Singapore, the Philippines, Thailand, Indonesia, Malaysia, and Vietnam.MyanmarGermany and Canada recorded the highest elevations in the last 90 days, rising by 6 and 5 victims, respectively, followed by Brazil, Colombia, Myanmar, and Romania.NetherlandsEuropean presence is limited, covering Germany, Italy, the Netherlands, France, and the United Kingdom.North KoreaNorth Korea-associated Lazarus Group ranks second overall, the only non-Chinese state actor with a significant presence.PhilippinesSoutheast Asian representation includes Singapore, the Philippines, Thailand, Indonesia, Malaysia, and Vietnam.PolandAustralia, France, Poland, Japan, and Spain saw the largest declines, all dropping out of the dataset entirely.RomaniaGermany and Canada recorded the highest elevations in the last 90 days, rising by 6 and 5 victims, respectively, followed by Brazil, Colombia, Myanmar, and Romania.Saudi ArabiaMiddle Eastern presence is confined to Saudi Arabia and the UAE.SingaporeAustralia, Germany, India, Singapore, and Taiwan form an even second tier, each recording identical counts.South KoreaThree separate state campaigns with named attribution, including nine months of undetected access in South Korea’s diplomat training system and a US indictment over IP theft valued in billions.SpainAustralia, France, Poland, Japan, and Spain saw the largest declines, all dropping out of the dataset entirely.TaiwanAustralia, Germany, India, Singapore, and Taiwan form an even second tier, each recording identical counts.ThailandSoutheast Asian representation includes Singapore, the Philippines, Thailand, Indonesia, Malaysia, and Vietnam.UAEMiddle Eastern presence is confined to Saudi Arabia and the UAE.United KingdomEuropean presence is limited, covering Germany, Italy, the Netherlands, France, and the United Kingdom.United StatesVictim distribution spans 23 countries, with the United States recording the highest victim count, followed by Japan.VietnamSoutheast Asian representation includes Singapore, the Philippines, Thailand, Indonesia, Malaysia, and Vietnam.
Industries
EducationEducation Industry Private & Faith-Based SchoolsPublic Schools & School Districts and Private & Faith-Based Schools followed at a considerable distance.Public Schools & School DistrictsPublic Schools & School Districts and Private & Faith-Based Schools followed at a considerable distance.Universities & Research InstitutionsUniversities & Research Institutions accounted for almost half of victims.