Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

guest · Dec 10, 2020

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data
Alert (AA20-345A)
December 10, 2020
https://us-cert.cisa.gov/ncas/alerts/aa20-345a

This Joint Cybersecurity Advisory was coauthored by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

The FBI, CISA, and MS-ISAC assess malicious cyber actors are targeting kindergarten through twelfth grade (K-12) educational institutions, leading to ransomware attacks, the theft of data, and the disruption of distance learning services. Cyber actors likely view schools as targets of opportunity, and these types of attacks are expected to continue through the 2020/2021 academic year.
These issues will be particularly challenging for K-12 schools that face resource limitations; therefore, educational leadership, information technology personnel, and security personnel will need to balance this risk when determining their cybersecurity investments.
Click to expand...

Ransomware
The FBI, CISA, and MS-ISAC have received numerous reports of ransomware attacks against K-12 educational institutions. In these attacks, malicious cyber actors target school computer systems, slowing access, and—in some instances—rendering the systems inaccessible for basic functions, including distance learning.
Malware
ZeuS and Shlayer are among the most prevalent malware affecting K-12 schools.
Distributed Denial-of-Service Attacks
Cyber actors are causing disruptions to K-12 educational institutions—including third-party services supporting distance learning—with distributed denial-of-service (DDoS) attacks, which temporarily limit or prevent users from conducting daily operations.
Video Conference Disruptions
Numerous reports received by the FBI, CISA, and MS-ISAC since March 2020 indicate uninvited users have disrupted live video-conferenced classroom sessions.
Click to expand...

Additional Risks and Vulnerabilities
Social Engineering
Cyber actors could apply social engineering methods against students, parents, faculty, IT personnel, or other individuals involved in distance learning. Tactics, such as phishing, trick victims into revealing personal information (e.g., password or bank account information) or performing a task (e.g., clicking on a link).
Technology Vulnerabilities and Student Data
Whether as collateral for ransomware attacks or to sell on the dark web, cyber actors may seek to exploit the data-rich environment of student information in schools and education technology (edtech) services.
Click to expand...

Open/Exposed Ports
The FBI, CISA, and MS-ISAC frequently see malicious cyber actors exploiting exposed Remote Desktop Protocol (RDP) services to gain initial access to a network and, often, to manually deploy ransomware.
End-of-Life Software
End-of-Life (EOL) software is regularly exploited by cyber actors—often to gain initial access, deface websites, or further their reach in a network.
Click to expand...

Log in or Sign up

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

guest Guest

Log in or Sign up

Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data

guest Guest

Useful Searches