MS-ISAC warned 808 K-12 groups that staff credentials circulated on dark web marketplaces

Help Net Security reported that the Multi-State Information Sharing and Analysis Center told 808 K-12 school organizations last school year that staff credentials were circulating on underground and dark web marketplaces.

Help Net Security reported that the Multi-State Information Sharing and Analysis Center is run by the Center for Internet Security. The 808 organizations are part of MS-ISAC’s 6,116 K-12 members. CIS assesses with high confidence that account takeover hopping will continue this school year. CIS calls the technique account takeover hopping, meaning attackers take over one account and use it to reach other targets.

Attackers have used hijacked K-12 accounts to pose as superintendents and commit fraud. MS-ISAC tracked cases where an attacker compromised one district account and used it to send phishing messages to contacts at other districts. The approach works because messages arrive from real accounts over authenticated email paths, which can weaken the filters schools rely on and lets one compromised district account become a pivot point for phishing against staff in neighboring districts. “We know that a single compromised account is all it takes to advance toward a more lucrative target,” Roy Park said.

CIS and MS-ISAC surveyed 426 school IT and security practitioners in August and September. At sixty-six percent of organizations, cybersecurity responsibility falls to one or two people. Eleven percent have no dedicated security staff.

Over budget limits led seventy percent to delay security projects, purchases, or hiring. Phishing or email compromise was the most common incident for eighty-seven percent. Multifactor authentication, which asks for more than one proof of identity, has been deployed by eighty-three percent of surveyed districts. Eighty-three percent filter email.

Fifty-nine percent keep an incident response plan. Fifteen percent hold regular incident response exercises. Nine percent call their security strategy implemented.

Fifty-one percent of surveyed districts experienced a cyber incident during the past 12 months. Disrupted classroom instruction was reported by twenty-two percent. Two percent reported school closures.

MS-ISAC’s Security Operations Center analyzed 2,707 incidents in which malicious activity reached a school-managed laptop, Chromebook, desktop, or server. Attackers tried to avoid detection in 1,711 incidents, about 63% of the total. Most often they disabled or modified security tools, seen in 881 cases.

About 65% of 1,796 infections from ten malware families seen at K-12 members came from malicious ads on legitimate websites. Analysts recorded 285 ClickFix incidents, in which users are talked into running malicious commands.

CIS recommends that district technology leaders expand multifactor authentication, monitor exposed credentials, review privileged accounts, and hold exercises each year, including tabletop and operational response drills with leadership. It also recommends recurring funding for states so districts can tap shared monitoring and incident response services.