Stolen K-12 staff logins used to phish other school districts
Original title: Stolen staff logins are spreading attacks between K-12 school districts
MS-ISAC notified 808 of 6,116 K-12 members that staff credentials were on underground markets and expects hopping to continue.
Last school year MS-ISAC told 808 K-12 organizations their staff credentials were circulating on dark web marketplaces. Attackers phish one district account, then email contacts at other districts over authenticated paths. CIS, which runs MS-ISAC, calls this account takeover hopping and assesses with high confidence it will continue. Of 426 surveyed practitioners, 66% have one or two security staff, and 51% reported an incident in the past 12 months.
Unconfirmed: Incident and staffing figures come from CIS and MS-ISAC analysis and a survey of 426 practitioners.
- Of 1,796 infections from ten common malware families, 1,159 traced to malicious ads.
- Analysts logged 285 ClickFix incidents that lure users into running commands.
- Eighty-seven percent named phishing or email compromise as their most common incident.
- Eighty-three percent deploy MFA and filter email; 15% hold regular response exercises.
- In 881 of 2,707 endpoint incidents, attackers disabled or modified security tools.
Impact: Stolen staff logins used for phishing, fraud, and further access
- 1.Expand MFA and monitor for exposed credentials.
- 2.Review privileged accounts.
- 3.Run at least one tabletop and one operational response exercise a year.
- ATT&CK
- T1566 PhishingT1078 Valid AccountsT1189 Drive-by CompromiseT1204 User ExecutionT1562.001 Disable or Modify Tools
From the original article
3 min read at helpnetsecurity.com
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces. That’s 808 of the center’s 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.