Last year, according to our Security Services Report, the number of high and medium-severity incidents in the education sector increased significantly, indicating systemic problems in this area. With less than a month left before the new school year, it’s time to highlight these issues.
Why do attackers target educational organizations? In public schools and universities, they can retrieve personal data, which is then used for phishing and other types of scams. In private schools, the most common critical incidents are encryption followed by ransom demands.
These observations were made by experts from our Global Emergency Response Team (GERT) based on an analysis of incidents that occurred over the past year in educational organizations in Brazil. However, the findings and recommendations of this study are also applicable to other countries. In particular:
— Advanced techniques are rarely used in attacks on educational organizations. Most often, initial access occurs through stolen accounts, then attackers escalate privileges (Potatoes) and navigate school networks using legitimate tools (PsExec, AnyDesk). To prevent account hijacking, it is recommended to use multi-factor authentication and regularly conduct audits of privileged accounts and reduce redundant rights.
— Schools and universities often use outdated software. For example, in the infrastructures of some of our clients from the education sector, we found Windows Server 2016 without patches, as well as Windows 10 operation system which is no longer supported. It is clear that the primary measure of prevention here is timely updates.
— The most popular families of ransomware attacking the education sector are DragonForce and LockBit 3. And, as already mentioned, ransomware attackers love private schools, which seem wealthy enough to pay a ransom. Such schools are especially recommended to develop a strategy for backup and data recovery.
More detailed examples of attacks on schools and universities, as well as additional recommendations for protection, can be found in the article by our expert Cristian Souza "An analysis of incidents at Brazilian educational institutions".
