[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI-HzUT6c78dEm84E6s9Z9wnxuLMPlvH4GR9Pcn2GxQc":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"dc510408-3c5e-4f05-b186-5d12f088a5e8","An analysis of incidents at Brazilian educational institutions","an-analysis-of-incidents-at-brazilian-educational-institutions-d81fb7","Kaspersky expert provides statistics and details on several incident response cases at educational institutions in Brazil, as well as tips for schools and universities on how to stay safe.","Kaspersky's analysis of incident response cases from January 2025 to June 2026 reveals that Brazilian educational institutions are frequent targets due to sensitive data. Attacks often involve ransomware like LockBit and DragonForce, with initial access gained through valid accounts, exploited applications, or insiders. The majority of incidents occurred in São Paulo, with private institutions being more heavily targeted by ransomware.","Kaspersky details cyberattacks on Brazilian educational institutions, including LockBit and DragonForce.","Table of Contents IntroductionKey findings and statisticsInteresting casesCase 01 – Leaked LockBit builderCase 02 – DragonForce deployed via AnyDeskCase 03 – Python keylogger used by an insiderConclusions and recommendationsObserved TTPs Authors Cristian Souza Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information (PII) that is often insecure or insufficiently tested against known vulnerabilities. In addition, machines used by multiple people without accountability can be vulnerable to insider threats. The complexity of academic environments amplifies this risk. Unlike corporate networks, educational institutions have to provide a network that supports students, professors, researchers, administrative staff, third-party contractors, and visitors. Each of these groups has different security requirements and access control levels, making it difficult to enforce consistent security policies. A security breach can have severe consequences since it may expose vast amounts of sensitive information, such as social security numbers (CPF in Brazil), addresses, phone numbers, and even parents’ names. Armed with this information, attackers can attempt phishing attacks and impersonate the victims in SIM swapping attacks, a common practice in Brazil. In this article, we provide details about attacks on educational institutions in Brazil observed by our Global Emergency Response Team (GERT) since 2025. We share general statistics, common threats, initial access vectors, and the impact of such violations. Additionally, we present some interesting cases encountered by our team and the identified TTPs. Finally, we offer recommendations to help institutions protect themselves against future attacks. Key findings and statistics Our dataset encompasses incident response cases from January 2025 to June 2026. As the chart below shows, the majority of attacks targeted institutions in São Paulo state, Brazil’s most populous state and a significant center of economic and financial activity. We also had cases in Rio de Janeiro and Pernambuco. Geographical distribution of incident response requests at educational institutions (download) Of the customers who requested incident response, 60% were private institutions and 40% were public institutions. Private and public institutions (download) The most frequent reasons for requesting IR services were related to suspicious endpoint activities, encrypted files, and the presence of suspicious files. Incident response request reasons (download) High-severity incidents accounted for 40% of the total cases, while the remaining 60% were medium severity. Distribution of incidents by severity (download) The high-severity incidents were mainly related to ransomware attacks. Interestingly, private institutions were the most targeted by ransomware, while incidents in public institutions were mostly related to suspicious endpoint activity and privilege escalation attempts. The most common ransomware families found in our dataset were DragonForce and LockBit 3, whose builder was leaked back in 2022. By using the leaked LockBit builder with a valid privileged account, attackers can build variants capable of disabling defenses and erasing logs. The most common initial access vectors included the use of valid accounts, exploitation of public-facing applications, and insiders. Initial access vectors (download) For privilege escalation, the attackers often relied on Potato variants (GodPotato, SweetPotato, and BadPotato). We also observed attackers using tools like AnyDesk for remote access, PsExec for lateral movement within compromised infrastructures, and AV-killer malware to terminate the system’s defenses. The latter was mainly used in ransomware-related incidents. These data reveal an interesting pattern in the threat landscape affecting educational institutions in the region. Many incidents were not caused by highly sophisticated techniques but rather by the abuse of common weaknesses such as valid accounts, exposed applications, and inadequate patch management, as well as the use of publicly available tools that are well-known to the adversaries. The prevalence of ransomware in private institutions suggests a stronger financial motivation, likely because attackers assume these organizations are more capable of paying for data recovery than public schools and universities. Most attacks were discovered promptly and lasted from a few minutes to a couple of hours. However, technical incident response activities averaged 9.6 hours. This indicates that the impact caused by an incident often extends beyond the timeframe of the active attack, requiring extensive triage and analysis by the forensic investigators to fully restore operations. One interesting fact is that we are still observing the use of Windows 10 in the infrastructures of educational institutions, even after Microsoft’s official end-of-support date of October 2025. In addition, we found that some customer organizations were using Windows Server 2016 without security patches and fixes. Using outdated and unsupported operating systems increases the attack surface of an infrastructure because attackers can exploit publicly available vulnerabilities to access vulnerable systems and expand their presence in the network. In addition, legacy operating systems may be incompatible with modern evidence collection tools, necessitating extra time and alternative procedures for forensic acquisition. Obsolete systems in organizations (download) Interesting cases Case 01 – Leaked LockBit builder In one case, we identified the use of a custom version of LockBit that was generated using the leaked builder. The ransomware was delivered to the organization’s infrastructure via a valid account that had been leaked. It encrypted the organization’s internal systems, including file servers and databases that stored student profiles and other data. There was no evidence of data exfiltration from the affected machines. During our analysis of the LockBit sample, we were able to extract its configuration. Interestingly, it was configured without the impersonation and spreading options. This meant the attacker had to perform manual lateral movement to deploy the malware across the network. \"config\": { \"settings\": { \"impersonation\": false, \"local_disks\": true, \"network_shares\": true, \"kill_processes\": true, \"kill_services\": true, \"set_wallpaper\": true, \"self_destruct\": true, \"kill_defender\": true, \"wipe_freespace\": true, \"psexec_netspread\": false, \"gpo_netspread\": false, … 1234567891011121314 \"config\": { \"settings\": { \"impersonation\": false, \"local_disks\": true, \"network_shares\": true, \"kill_processes\": true, \"kill_services\": true, \"set_wallpaper\": true, \"self_destruct\": true, \"kill_defender\": true, \"wipe_freespace\": true, \"psexec_netspread\": false, \"gpo_netspread\": false,… Further analysis revealed that the attacker used PsExec for lateral movement. By analyzing the Update Sequence Number (USN) Journal, we were able to identify .KEY files associated with PsExec that showed us the previously compromised machines used by the attacker. After gaining access to the target machines, the adversaries deployed a batch script to disable the system’s defenses. Our analysis of this artifact showed that they had the administrative credentials to disable the EDR in place. In addition, the script enabled RDP, which gave the attackers remote access to the target. The listing below shows an excerpt of the script: reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \u002Fv fDenyTSConnections \u002Ft REG_DWORD \u002Fd 0 \u002Ff netsh advfirewall firewall add rule name=\"allow RemoteDesktop\" dir=in protocol=TCP localport=3389 action=allow reg add \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" ","https:\u002F\u002Fsecurelist.com\u002Fincidents-at-brazilian-educational-institutions\u002F120803\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F24112055\u002FSL-incidents-at-Brazilian-educational-institutions-featured-scaled-1.jpg","2026-08-03T13:00:17+00:00","2026-08-03T14:00:25.010606+00:00",8,[18,21],{"name":19,"type":20},"Kaspersky","vendor",{"name":22,"type":23},"AnyDesk","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":24,"icon":26,"name":27,"slug":28},null,"Threat Intelligence","threat-intelligence",[30,35,40,45],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":26,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[51,54,56,58,61,64],{"type":44,"value":52,"context":53},"LockBit 3","Ransomware family observed in attacks",{"type":44,"value":55,"context":53},"DragonForce",{"type":44,"value":22,"context":57},"Tool used for remote access in compromised infrastructures",{"type":44,"value":59,"context":60},"PsExec","Tool used for lateral movement within compromised infrastructures",{"type":44,"value":62,"context":63},"AV-killer","Malware used to terminate system defenses, especially in ransomware incidents",{"type":44,"value":65,"context":66},"Potato variants","Used for privilege escalation (GodPotato, SweetPotato, BadPotato)"]