An analysis of incidents at Brazilian educational institutions
ID: fe3df834-6b31-5c0e-bb30-657cf0e1031c
STIX ID: report--fe3df834-6b31-5c0e-bb30-657cf0e1031c
Feed Name: Securelist by Kaspersky
### Executive summary — This Global Emergency Response Team report summarizes incident response cases (Jan 2025–Jun 2026) against Brazilian educational institutions, highlighting frequent ransomware (LockBit variants, DragonForce) delivered via leaked/valid credentials and remote access tools, lateral movement using PsExec and RDP, and an insider-operated Python keylogger; it documents forensic artifacts (Prefetch, Amcache, USN, MFT, PCA, UserAssist), observed TTPs, geographical and severity statistics, and actionable recommendations to improve MFA, patching, backup isolation, and forensic visibility.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.