India's education sector records the highest domestic cyber-detection rate of any industry, faces ransomware double-extortion against a premier institution, and is within reach of a China-nexus espionage group running active campaigns in India with research-partnership lure themes. Three widely-deployed VPN and MDM products carry unpatched critical vulnerabilities, and a student-data compliance deadline is approaching.
1. Sector snapshot
Seqrite's India Cyber Threat Report 2026 (over 8 million endpoints monitored, October 2024 – September 2025) places education first among all domestic sectors at approximately 24% of total detections across 265.52 million recorded events. Trojans dominate; file infectors and worms propagate through shared campus networks. The threat mix extends well beyond defacement and phishing to ransomware extortion, MDM compromise, and structured espionage.
Source (with date): Seqrite India Cyber Threat Report 2026; IT Voice (4 Dec 2025).
2. Threats targeting Education
1
DragonForce ransomware — BITS Pilani (June 2026)
DragonForce listed Birla Institute of Technology and Science, Pilani on its leak portal on 22 June 2026, claiming an attack around 20 June. The group's posting described employee accounts, user credentials, and third-party data as exposed. DragonForce operates a double-extortion model — encryption plus threatened data publication — and demonstrates that premium engineering institutions are selected targets, not incidental victims.
SourceDeXpose; RedPacket Security; ransomware.live (22 Jun 2026).
2
Rising ransomware volume; APT campaigns surge
Check Point Research recorded 4,816 weekly attacks against education in June 2026, up 16% year-on-year, with India among the five most-targeted countries globally. CyberSecurityNews and GBHackers report education appeared in 20% of all observed APT campaigns in Q1 2026, led by China-linked groups. Attack focus falls on email, FTP, and SSHD infrastructure rather than perimeter devices, indicating research-data exfiltration as the primary objective.
SourceCheck Point Research; CyberSecurityNews; GBHackers (Jul 2026).
Two unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile are under active, automated exploitation. CVE-2026-1281 (CVSS 9.8) is in the CISA KEV catalog. Post-exploitation payloads include web shells and persistent backdoors on MDM servers. Universities using EPMM to manage student and staff devices face adversary control of the device-management layer.
SourceUnit 42 / Palo Alto Networks; Tenable; Help Net Security (30 Jan 2026); CISA KEV.
Advisory published 13 May 2026. An unauthenticated attacker forges a valid authentication-override cookie using the portal's own HTTPS certificate. Rapid7 confirmed widespread exploitation from 17 May 2026; CISA KEV remediation deadline was 1 June 2026. University GlobalProtect deployments unpatched beyond that date are a current exposure.
SourceHelp Net Security; Rapid7; Unit 42 / Palo Alto Networks; CISA KEV (1 Jun 2026).
An active campaign extracts configuration files from internet-facing FortiGate firewalls and cracks stored administrator hashes. Arctic Wolf, BitSight, and the Cloud Security Alliance documented 30,000–86,000 affected devices across 194 countries. No new CVE is involved; it exploits the legacy SHA-256 password scheme replaced in FortiOS 7.2.11, 7.4.8, and 7.6.1.
SourceArctic Wolf; BitSight; Cloud Security Alliance (20 Jun 2026).
6
Check Point Remote Access VPN CVE-2026-50751
Critical authentication bypass in Check Point Remote Access VPN using deprecated IKEv1, exploited since at least 7 May 2026. Post-compromise activity in one confirmed case was attributed to a Qilin ransomware affiliate. Apply the hotfix, disable IKEv1 remote access, and audit sessions from May onward.
SourceCheck Point Blog; Rapid7; Cybersecurity Dive (8 Jun 2026).
MeitY notified the DPDP Rules on 13 November 2025. Educational institutions processing student data are data fiduciaries; processing personal data of minors requires verifiable parental consent. Penalties reach ₹250 crore per violation. Phase III obligations — consent management, breach notification, data minimisation — take effect May 2027. The Data Protection Board is operational from November 2025. ORF research (2026) notes the absence of EdTech-specific standards as a gap to address before enforcement.
CERT-In's April 2022 directions require educational institutions to report specified incidents within six hours. Where student or staff personal data is involved, the same event simultaneously triggers DPDP Board notification. Institutions running NIC-hosted portals or DigiLocker-integrated systems must map both reporting tracks in incident response plans.
5. Actor in focus — Mustang Panda (Earth Preta / TA416 / TWILL TYPHOON)
Mustang Panda is a China-nexus espionage actor with sustained targeting of Indian government, defence, and research organisations. Acronis Threat Research Unit attributed two concurrent campaigns to this group with beaconing observed 12–22 June 2026. Targets were a hydropower cooperation agency and a government body with institutional ties to Taiwan.
Both campaigns used spear-phishing ZIP archives exploiting DLL sideloading through legitimate signed binaries — Solid PDF Creator and a Citrix Receiver executable. The malware chain: SHARDLOADER (DLL loader) → MINIRECON (Toneshell variant, WebSocket C2 over HTTPS) + ZOHOMURK (Zoho WorkDrive dead-drop using hardcoded Zoho OAuth credentials). Persistence via a Run key and scheduled task SolidPDFPcl2Bmp. Lure documents themed around cooperation frameworks and institutional MoUs are directly applicable to university research partnership and international-relations offices, which handle similar document flows daily.
Source (with date): Acronis Threat Research Unit; The Hacker News; TechTimes (30 Jun 2026).
6. IOC pack
All indicators from named public threat intelligence; no internal Nirad telemetry.
Board: The BITS Pilani incident and the DPDP enforcement timeline together warrant a board decision. Approve a ransomware readiness assessment and student-data classification programme before May 2027.
CISO: Within 14 days, audit all internet-facing campus infrastructure. Patch PAN-OS against CVE-2026-0257; upgrade Ivanti EPMM beyond the CVE-2026-1281/1340 fix; apply the Check Point IKEv1 hotfix and disable legacy remote-access configurations; verify FortiOS is at or above 7.2.11/7.4.8/7.6.1 and rotate all FortiGate administrator credentials. Build a breach-notification workflow that satisfies CERT-In's six-hour deadline and the DPDP Board requirement simultaneously. Review research computing endpoints for Mustang Panda DLL-sideloading indicators.
SOC: Hunt Mustang Panda: Solid PDF Creator or Citrix Receiver spawning unexpected child processes; scheduled task SolidPDFPcl2Bmp; outbound HTTPS to couldinstallup[.]com or 188.208.141.177; non-browser Zoho WorkDrive API calls. For VPN/MDM: check GlobalProtect for cookie-based authentication anomalies; inspect EPMM directories for web shells and rogue admin accounts; audit Check Point IKEv1-configuration session logs from 7 May 2026 onward.
8. Source index
Acronis Threat Research Unit · Arctic Wolf · BitSight · Check Point Blog · Check Point Research · CERT-In · CISA KEV · Cloud Security Alliance · CyberSecurityNews · Cybersecurity Dive · DeXpose · ECSINFOTECH · GBHackers · Help Net Security · IT Voice · MeitY / DPDP Rules 2025 · ORF Online · Rapid7 · ransomware.live · RedPacket Security · Seqrite India Cyber Threat Report 2026 · TechRadar · TechTimes · Tenable · The Hacker News · Unit 42 / Palo Alto Networks · Welthwest
