Education sector faces a rise in state espionage, phishing, and supply chain attacks

Schools, universities, and research institutions are facing a sharper cyber threat in 2026, with state-backed hackers showing renewed interest in education networks.

CYFIRMA’s Q1 2026 education threat report found that education appeared in 20% of observed advanced persistent threat campaigns, up from none in the previous period.

The main concern is not only ransomware. Researchers found state-sponsored espionage activity, spear-phishing, supply chain attacks, dark web chatter, and DDoS-related disruption all affecting the sector at the same time.

Education is now a state espionage target

The biggest change in Q1 2026 was the type of attackers involved. CYFIRMA said all observed APT campaigns linked to education had a state-sponsored profile, with no financially motivated actors in that APT group.

China-linked groups led the activity. MISSION2074 appeared most often, followed by Stone Panda, Hafnium, and Lotus Blossom. Iran-linked Charming Kitten was the only non-Chinese state actor named in the report.

This points to a clear motive. Universities and research institutions hold valuable intellectual property, research data, government-funded projects, and sensitive communications that foreign intelligence groups want to access.

Threat area	Q1 2026 finding
APT campaign presence	Education appeared in 5 of 25 observed campaigns
Change from prior period	Up from zero observed APT campaigns
Threat profile	Exclusively state-sponsored among observed APT campaigns
Leading attribution	China-linked groups, led by MISSION2074
Other named actor	Iran-linked Charming Kitten

Attackers are going after communications and research access

The technology targeted in education differs from many other sectors. Instead of focusing mainly on VPNs, routers, and perimeter network devices, attackers targeted web applications, email servers, FTP servers, and SSHD servers.

That pattern suggests attackers want access to documents, academic communication, research systems, and institutional accounts. It also shows why universities and schools need to protect more than classroom platforms.

Email servers remain especially important because they can expose research discussions, partner communications, grant information, identity data, and login reset paths for other systems.

Victims were spread across 27 countries

CYFIRMA found education-related APT victim distribution across 27 countries. The United States recorded the highest victim count, followed by the United Kingdom, Japan, India, South Korea, and Germany.

The spread was broader than in many other sectors. European countries appeared more prominently, while Myanmar and Hong Kong also appeared in the mid-frequency tier.

The report links this pattern to China-linked targeting of diaspora communities and regional research institutions. Gulf states also appeared, matching known Iranian interest in academic and research targets in the Middle East.

Region or country group	Why it matters
United States	Highest victim count in the dataset
United Kingdom, Germany, and Europe	Stronger representation than many other sectors
Japan, India, and South Korea	Major education and research hubs in Asia
Myanmar and Hong Kong	Mid-frequency targets linked to regional interest
Gulf states	Relevant to Iranian academic targeting patterns

Spear-phishing and supply chain attacks remain major risks

Beyond APT activity, CYFIRMA tracked 12 publicly reported cyber incidents involving education organizations in Q1 2026. That represented 1.49% of identified industry-linked incidents.

The volume may look low, but the report warns that education incidents may be underreported. Schools and universities often have complex supplier networks, limited security budgets, and many users who need open access to digital tools.

The main identified techniques were spear-phishing and supply chain attacks. Both are serious for education because institutions depend heavily on learning platforms, research tools, cloud services, contractors, and external collaboration portals.

• Spear-phishing can target staff, faculty, students, researchers, and administrators.
• Supply chain attacks can reach institutions through trusted education software or vendors.
• Email compromise can expose research projects and internal communications.
• FTP and SSHD targeting can put stored research data and server access at risk.
• Weak supplier reviews can leave schools exposed through third-party systems.

Ransomware dropped, but universities remain exposed

Ransomware victim numbers declined in the education sector during Q1 2026. CYFIRMA counted 54 verified ransomware victims, down from 72 in the previous quarter.

That 25% drop is a positive sign, but it does not remove the risk. Universities and research institutions still made up the largest share of education ransomware victims, followed by public schools and school districts.

Interlock stood out as the most education-focused ransomware group in the report. It directed 27.3% of its total victims toward education organizations, far above the sector average among groups with more than two victims.

Ransomware metric	Q1 2026 finding
Verified education victims	54
Previous quarter	72
Quarterly change	Down 25%
Most affected education category	Universities and research institutes
Most education-focused gang	Interlock

Dark web chatter points to disruption risk

The education sector also saw notable movement in underground and dark web chatter. CYFIRMA tracked 3,536 mentions tied to education organizations across the 90-day period.

The strongest signals came from hacktivism and DDoS-related chatter. Hacktivism mentions rose from 28 to 216 across the period, while DDoS chatter jumped sharply in the final 30 days.

This matters because schools and universities can become targets during geopolitical tension, campus policy disputes, regional conflicts, or ideological campaigns. Disruption can affect classes, exams, research access, and public-facing portals.

Phishing remains the everyday threat

The state-backed activity is important, but basic phishing still creates the most common doorway for many education attacks. The UK government’s 2025/2026 education cyber survey found phishing was the top reported threat across schools, colleges, and universities that identified breaches or attacks.

The survey found that 73% of secondary schools, 88% of further education colleges, and 98% of higher education institutions identified breaches or attacks in the previous 12 months.

Among those that identified a breach, phishing affected 90% of primary schools, 96% of secondary schools, and 96% of further and higher education institutions combined.

Institution type	Identified breaches or attacks in the last 12 months
Primary schools	49%
Secondary schools	73%
Further education colleges	88%
Higher education institutions	98%
Businesses overall	43%

What education organizations should do now

Education leaders should treat cybersecurity as a research protection issue, not just an IT support issue. The same systems that support teaching can also store grant data, personal records, credentials, and sensitive collaboration files.

Email, FTP, SSHD, and web application security should move to the top of the priority list. These were the technologies that stood out in the APT data, and they often give attackers direct access to communications and stored files.

Supply chain reviews also need more attention. Schools and universities use many external systems, including learning platforms, payment providers, research tools, cloud storage, and student management systems.

• Enforce multi-factor authentication across email, research platforms, VPNs, and admin portals.
• Harden email, FTP, SSHD, and web application servers.
• Patch known remote code execution and injection vulnerabilities quickly.
• Review third-party vendors and education software suppliers for security risk.
• Train staff and students to report spear-phishing attempts.
• Monitor dark web chatter for leaked credentials and planned disruption campaigns.
• Segment research systems from general student and administrative networks.
• Test incident response plans before exams, admissions deadlines, and research milestones.

FAQ