[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWnK5CSrxiFuImx-TwzNXXKZ8Qq6g_-Bwq8dgMoulitQ":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"a14a0726-63e8-4d35-9d96-ff8de404c5d8","Canadian extradited to US for allegedly hacking schools in at least four states","canadian-extradited-to-us-for-allegedly-hacking-schools-in-at-least-four-states-63e355","The Department of Justice said it identified two suspects in a case that dates back to 2016 and involved illicit cryptomining on the computers of U.S. educational institutions.","Two Canadian nationals have been indicted by the U.S. Department of Justice for a hacking campaign that began in 2016. The suspects allegedly compromised computers in at least four U.S. educational institutions to mine cryptocurrency, using European servers and compromised victim machines to conceal their activities. One suspect has been extradited to the U.S. to face charges, while efforts are underway to extradite the second.","Canadian extradited to US for alleged 2016 school hacking and cryptomining.","https:\u002F\u002Ftherecord.media\u002Fcanadian-nationals-accused-us-education-hacks-cryptomining","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fus_canada_flags_pexels_thomas_k_cb8bc816e8.jpg","2026-11-04T19:17:00+00:00","2026-11-04T20:00:32.796817+00:00",7,[17,20],{"name":18,"type":19},"Ryan James Roach","threat_actor",{"name":21,"type":19},"Mathiew James Stubbings","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":22,"icon":24,"name":25,"slug":26},null,"Nation-state","nation-state",[28,33,35,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":48,"vendors":135},[49,77,106],{"slug":50,"name":51,"problem":52,"products":53},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":72,"url":75,"description":76},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":107,"name":108,"problem":109,"products":110},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":148},"canadian-hackers-compromise-us-schools-for-crypto-mining","Canadian Hackers Compromise US Schools for Crypto Mining","Two Canadian nationals exploited vulnerabilities in U.S. educational institutions' computer systems over multiple years, using compromised machines and foreign servers to mine cryptocurrency while evading detection. The extended duration of the campaign — beginning in 2016 — suggests that schools lacked adequate monitoring to detect unauthorized resource consumption or unusual outbound network traffic. Educational institutions are frequently under-resourced for cybersecurity, making them attractive targets for attackers seeking compute power. This case highlights that even non-sensitive targets like schools can be weaponized as infrastructure for financially motivated cybercrime, and that prolonged undetected access causes lasting harm.",[141,142,143,144,145,146,147],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1496: Resource Hijacking","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"MITRE ATT&CK T1496: Resource Hijacking":151,"CIS Control 17: Incident Response Management":152,"CIS Control 7: Continuous Vulnerability Management":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":155},"NIS2 requires entities to implement incident handling and monitoring measures; had equivalent standards applied to these educational institutions, the prolonged cryptomining campaign would likely have been detected and disrupted much earlier.","This control mandates identifying, reporting, and correcting system flaws; had schools followed a structured flaw remediation process, the vulnerabilities leveraged by the attackers would have been addressed before exploitation.","The attackers' primary objective was unauthorized use of school computing resources for cryptocurrency mining, a textbook resource hijacking technique that endpoint monitoring and anomaly detection are specifically designed to catch.","A formal incident response capability would have enabled schools to detect, contain, and eradicate the cryptomining intrusion far sooner than the multi-year window the attackers were allowed to operate.","Regular vulnerability scanning and timely patching of school systems would have identified and closed the security weaknesses the attackers exploited to gain initial access.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, which would have driven the patching needed to prevent the attackers' initial compromise.","Stronger authentication and access controls on school systems would have made it significantly harder for the attackers to compromise machines and maintain persistent unauthorized access."]