“Our dataset encompasses incident response cases from January 2025 to June 2026.” Between those dates, incident response requests from Brazilian educational institutions clustered most heavily in São Paulo, with additional cases in Rio de Janeiro and Pernambuco.
Geography, ownership, and severity
The incidents reviewed by the Global Emergency Response Team (GERT) show a clear geographic and ownership pattern: most requests came from São Paulo, and 60% of customers were private institutions while 40% were public. High-severity incidents comprised 40% of the caseload and were mainly related to ransomware; the remaining 60% were medium-severity events driven by suspicious endpoint activity and privilege-escalation attempts. Private institutions were disproportionately targeted by ransomware, while public institutions more often faced suspicious endpoint and privilege escalation activity.
Initial access vectors and familiar tools
Across the dataset, attackers favored readily available weaknesses over novel exploits. The most common initial access vectors were the use of valid accounts, exploitation of public-facing applications, and insiders. For privilege escalation, attackers repeatedly used Potato variants (GodPotato, SweetPotato, BadPotato). For lateral movement and persistence the incidents commonly involved PsExec and remote-access software such as AnyDesk. In ransomware cases investigators observed AV‑killer malware used to terminate defenses and techniques that disabled or erased logs. The report also notes ongoing use of legacy operating systems — including Windows 10 after Microsoft’s official end-of-support date of October 2025, and unpatched Windows Server 2016 — which increased exposure to known vulnerabilities and complicated forensic acquisition.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Three illustrative cases: LockBit, DragonForce, and an insider keylogger
- Leaked LockBit builder. One organization was compromised through a leaked valid account. GERT identified a custom LockBit variant generated with a builder leaked in 2022; the ransomware encrypted file servers and databases holding student profiles. The LockBit configuration lacked impersonation and automated spreading options, requiring manual lateral movement. Investigators found PsExec usage by checking the USN Journal and Prefetch files, and recovered a batch script the attacker used to disable Defender and enable RDP (examples included commands that set fDenyTSConnections to 0, opened TCP/3389, and disabled Defender real‑time protections). Timeline artifacts showed the attacker connected at about 05:30 UTC and ran the LockBit binary last at ~10:00 UTC — an activity window of approximately four and a half hours.
- DragonForce via AnyDesk. In a separate incident, a compromised account permitted installation of AnyDesk; ransomware execution evidence was partially erased but recovered through Prefetch and Amcache.hve, which yielded the SHA‑1 of a sample (named 1.EXE) later identified as a DragonForce variant. The case underscores how attackers may attempt to remove logs while leaving other artifacts intact.
- Python keylogger used by an insider. A shared user account on a multi‑user machine ran two suspicious EXE files located in a .vscode directory. Forensic artifacts (PCA, Amcache.hve, Prefetch, UserAssist, MFT) showed repeated execution. Both EXEs were the same Python keylogging script, decompiled by investigators; the script hid log files, tracked Caps Lock state, and wrote increasing cacheX.txt files. It implemented no persistence or automated exfiltration, and investigators found contemporaneous USB connections — suggesting manual removal of logs via removable media. The institution changed all affected passwords, but without conclusive attribution to a specific individual no disciplinary or legal action followed.
Recommended controls and forensic practices
GERT’s findings point to a compact set of preventive and investigative measures. Preventive controls the report recommends include enforcing multi-factor authentication for publicly accessible services (VPNs, remote access portals, email), periodic review and removal of unnecessary privileged accounts, elimination of shared accounts (particularly on multi-user machines), restricting and monitoring remote‑access tools such as AnyDesk and TeamViewer, and improving backup strategies (isolated backups, multi-location, and regular testing). Organizations should adopt robust patch management to remove exposure from obsolete systems.
From a DFIR perspective, the report emphasizes centralized logging, extended EDR telemetry retention, proper time synchronization across hosts, and the need to correlate diverse forensic artifacts — Amcache, Program Compatibility Assistant (PCA), Prefetch, UserAssist, MFT, and the USN Journal — to reconstruct attacker actions when primary logs are missing or erased.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Prioritize MFA for public-facing services, inventory and reduce privileged accounts, remove shared accounts on communal machines, and ensure backups are isolated and tested. Expect to rely on artifacts such as Amcache and USN Journal when attackers erase logs.
- Procurement and institutional leaders: Factor patch status and vendor support into buying decisions; the continued presence of Windows 10 after its October 2025 end-of-support date and unpatched Windows Server 2016 were highlighted as risk multipliers in the dataset.
- End users and administrators: Avoid credential sharing, treat unexpected remote‑access installs as high‑priority alerts, and follow procedures that limit removable‑media access where sensitive data or shared accounts exist.
The pattern across these incidents is stark: attackers often depend on stolen credentials, exposed services, and well-known public tools rather than novel exploits. For Brazilian educational institutions that mix public and private responsibilities across shared environments, the immediate priorities are clear — enforce MFA, close unnecessary privileges, harden endpoints, and preserve the forensic breadcrumbs that reveal what attackers do when they think they’re erasing their tracks.
https://securelist.com/incidents-at-brazilian-educational-institutions/120803/
