Education & Research — Cyber Threat Activity
Threat actors, incidents and malware targeting the Education & Research sector — 571 recorded incidents and 92 tracked groups.
- Recorded incidents: 571
- Incidents, trailing 180 days: 140
- Tracked threat actors: 92
- Malware families: 123
Recent incidents
- Laurel Institutes 2026-08-05
- Surakarta University 2026-08-05
- Centro Universitário CESMAC (CESMAC University Center) 2026-08-04
- Loyalist College 2026-08-04
- Universitatea De Vest Vasile Goldi Din Arad 2026-08-03
- Efrata College of Education 2026-07-31
- Collge Mont Notre-Dame de Sherbrooke 2026-07-30
- landesmuseum.de 2026-07-27
- braywoodschool.co.uk 2026-07-27
- vit-best.com 2026-07-27
- Newcastle University 2026-07-26
- District of Columbia Public Schools 2026-07-26
- Universitatea de Vest „Vasile Goldiș” din Arad 2026-07-26
- Kean University 2026-07-24
- Highline Community College 2026-07-24
- upland.k12.ca.us 2026-07-24
- Salida Union School District 2026-07-22
- St. Francis Xavier Catholic School System 2026-07-21
- Universidad Nacional de Mar del Plata 2026-07-20
- College O'Sullivan de Québec 2026-07-20
Threat actors targeting Education & Research
- Qilin 66 incidents
- INC Ransom 48 incidents
- SafePay 38 incidents
- LockBit 29 incidents
- RansomHub 28 incidents
- Fog Ransomware 27 incidents
- Rhysida 19 incidents
- FunkSec 18 incidents
- Medusa Ransomware 16 incidents
- ShinyHunters 15 incidents
- KillSec 13 incidents
- Cl0p 12 incidents
- Lynx Ransomware 11 incidents
- The Gentlemen 10 incidents
- NightSpire 9 incidents
- Nova 7 incidents
- DragonForce 6 incidents
- BlackSuit 5 incidents
- CMD 5 incidents
- Krybit 5 incidents
- 8Base 4 incidents
- Payload 4 incidents
- Stormous 4 incidents
- World Leaks 4 incidents
Where these victims are
- United States 362
- United Kingdom 27
- Canada 19
- France 14
- Brazil 11
- India 11
- Australia 10
- Germany 8
- Romania 6
- Italy 5
- Israel 4
- Mexico 4
Malware used against Education & Research
Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.
- Akira Malware
- Cobalt Strike Malware
- Impacket Tool
- Mimikatz Tool
- PlugX Malware
- PsExec Tool
- Sliver Tool
- AdFind Tool
- China Chopper Malware
- DarkComet Malware
- Empire Tool
- gh0st RAT Malware
Coverage. 76.7% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.