Education — threat intelligence
Recent advisories whose title or summary heuristically matches the Education sector. Derived in-browser/at-edge from a keyword catalog — treat tags as a hint and open each source for ground truth. The underlying feed updates hourly; this page is a snapshot from its last build (timestamped below).
11 recent Education advisories
Snapshot built . The live filter and the RSS feed reflect new items as they arrive.
-
In Rare Move, Alleged Iranian State Hacker Extradited to US
Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad. The post In Rare Move, Alleged Iranian State Hacker Extradited to US appear…
-
Iranian accused of hacking American universities extradited from Montenegro
An Iranian national accused by the U.S. of taking part in dozens of breaches involving the theft of academic data and intellectual property has been extradited from Montenegro.
-
Connected Cars Are a Surveillance Platform
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: To determine this, CR dug through thousands of pages of automakers’ privacy policies and asked questions of…
-
Higher education is under siege, and fragmented security is making it harder to respond
Higher education faces a difficult security equation. Universities hold large volumes of sensitive student, financial, health, and research data while supporting open networks, distributed users, legacy infrastructure, and increasingly comp…
-
'NeedyMantis' Provides Long-Term Access to Compromised Networks
Microsoft observed a China-based actor using a previously unidentified malware framework in targeted intrusions against telcos, universities, medical, and government-related organizations.
-
RemoteThreat Launches With $7 Million for Offensive Operations Platform
The company emerged from stealth mode with pre-seed funding from Osage University Partners and DataTribe. The post RemoteThreat Launches With $7 Million for Offensive Operations Platform appeared first on SecurityWeek.
-
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecomm…
-
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC62…
-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through s…
-
Cyberattack hits University of Munich, potentially exposing student financial data
The university, commonly known as LMU Munich, said Saturday that an attacker accessed enrollment data stored on one of its IT systems.
-
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking online (via Zoom) at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conferen…
Other sectors: Government ·Healthcare ·Finance ·Energy ·Critical Infra ·Technology ·Telecom ·Defense ·Retail ·Transportation ·Legal Services
Threat groups reported to target Education
MITRE ATT&CK records 17 tracked groups with reported targeting of this sector. Each links to its ATT&CK profile: techniques by tactic, aliases, tooling and the groups closest to it by technique overlap. Reported targeting is not attribution of any specific advisory above.
Ajax Security Team ·Aoqin Dragon ·APT-C-23 ·APT41 ·APT42 ·Aquatic Panda ·Cleaver ·Daggerfly ·Earth Lusca ·HEXANE ·Kimsuky ·Molerats ·OilRig ·TA505 ·Turla ·VOID MANTICORE ·Winnti Group
Also on ThreatFilter: cross-source corroborated CVEs · threat group directory · every source we track