Ransomware crews are getting into Brazilian schools and universities the boring way: with logins that already work. Kaspersky's Global Emergency Response Team has reviewed the incidents it was called into at educational institutions in Brazil between January 2025 and June 2026, and the picture it paints is less about clever intrusions than about doors left open.
Researcher Cristian Souza published the analysis on 3 August 2026. Most of the cases came from Sao Paulo state, Brazil's most populous and its economic center, with further cases in Rio de Janeiro and Pernambuco. Sixty percent of the institutions that called for help were private and forty percent public.
What the cases looked like
High-severity incidents accounted for 40% of the total cases, with the remaining 60% rated medium. The high-severity ones were mainly ransomware, and there is a clear split by sector: private institutions were the most targeted by ransomware, while public institutions mostly reported suspicious endpoint activity and privilege escalation attempts. Souza reads the split as financial, with attackers assuming private schools and universities are likelier than public ones to pay for data recovery.
The two ransomware families that showed up most often were DragonForce and LockBit 3, the latter built with the builder that leaked back in 2022. With that builder and a privileged account, an attacker can assemble a variant that disables defenses and wipes logs without ever writing code.
The most common initial access vectors were valid accounts, exploitation of public-facing applications, and insiders. Once inside, attackers reached for Potato variants (GodPotato, SweetPotato and BadPotato) to escalate privileges, AnyDesk for remote access, PsExec for lateral movement, and AV-killer malware to shut down security tools before deploying ransomware.
Three cases worth reading
- A custom LockBit build generated from the leaked builder arrived through a leaked valid account and encrypted file servers and databases holding student profiles. Kaspersky found no evidence of data exfiltration. The extracted configuration had impersonation and network spreading switched off, which meant the operator had to move through the network by hand.
- DragonForce ransomware deployed over AnyDesk.
- A Python keylogger planted by an insider, the risk that comes with machines used by many people and accountable to none.
Most of the attacks were spotted promptly and ran from a few minutes to a couple of hours, but technical incident response activities averaged 9.6 hours. The damage outlasts the intrusion.
Why schools are worth attacking
Educational institutions hold large amounts of personally identifiable information about people who are often minors: CPF numbers, addresses, phone numbers, even parents' names. Souza notes that this is directly useful for phishing and for impersonating victims in SIM swapping attacks, a common practice in Brazil. Brazilian users are already a heavily worked target: a banking trojan campaign documented in July hijacked WhatsApp sessions to spam victims' own contacts, and our Brazil country profile tracks the wider picture.
Kaspersky also flags an uncomfortable amount of legacy infrastructure. Investigators still found Windows 10 in use after Microsoft's October 2025 end-of-support date, and Windows Server 2016 running without security patches. Beyond the obvious exposure to public exploits, obsolete systems can be incompatible with modern evidence collection tools, which stretches out every forensic investigation.
What you should do
Nothing in this dataset requires an exotic defense. Enforce multi-factor authentication on every account that can reach internal systems, because valid credentials were the leading way in. Patch and inventory anything public-facing. Retire unsupported Windows builds or isolate them properly. Alert on AnyDesk and PsExec appearing where they are not part of the IT toolkit, and on any process trying to stop security services. Finally, treat shared lab and administrative machines as an insider risk surface, with per-user accounts and logging rather than a common login everyone knows.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.