Blog
/
/
March 7, 2019

State-Sponsored Cyber Attacks on Colleges

Discover how universities should embrace cyber AI to safeguard research and intellectual property while maintaining campus connectivity.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
07
Mar 2019

Securing higher education institutions poses a unique challenge compared to just about any other type of organization, from governments to nonprofits to private companies.

Higher education institutions typically prioritize an open-access IT environment, which must balance an interest in facilitating the free exchange of ideas with the imperative of robust cyber defenses to protect against intellectual property theft. Indeed, the marked rise in cyber-attacks over the past three years has not been exclusive to the private sector. Universities are, in fact, a high-value target for any cyber-criminal, as their networks hold a wealth of sensitive information, ranging from student financial details to social security numbers to cutting-edge research. And crucially, the nature of this research makes universities a prime target for advanced, state-sponsored attackers, as this information can be highly valuable to foreign governments.

The week’s news of attacks by Chinese criminals on more than two dozen universities — including MIT, The University of Hawaii, and The University of Washington — demonstrate just how serious such attacks can be. The group allegedly responsible for these attacks, Mudcarp, attempted to steal highly sensitive military research on submarine missiles using targeted phishing emails. Ostensibly written by trusted colleagues at partner universities and research institutions, these emails delivered malicious payloads by exploiting macros in Microsoft Word and Excel documents, thereby gaining access to sensitive collegiate networks. Due to the value of the technology in question, experts have speculated that these attacks were likely state-sponsored as part of China’s efforts to advance its naval operations.

A defensive nightmare

Despite containing lucrative IP and vast quantities of personal information, university networks are among the most difficult to secure. For one, the high number of both students and staff connecting to the network each day means universities must deploy hundreds, if not thousands of access points, and in contrast to private businesses, it is nearly impossible to guarantee that these access points are tightly secured. This reality makes gaining an initial foothold in the network — one of the most difficult and time-consuming stages of the attack life cycle — far easier. Moreover, as higher education institutions often facilitate high-traffic networks, they must deploy a decentralised system, with different faculties responsible for the security of their specific portion of the network. While it is common practice in the private sector, deploying a uniform set of security policies proves difficult in a university environment.

To make matters worse, an increasing number of students are now connecting multiple BYOD devices to the network, and as a consequence, higher education institutions typically have a far greater attack surface than private businesses. And at the same time, the continuous stream of students on campus also increases the difficulty of distinguishing between genuine security threats and benign — albeit undesirable — activity, such as video torrenting. This open-access culture also negatively impacts users’ attitude towards risk, with students less likely to feel responsible for their network activity compared to employees of a private business. In other words, users of higher education networks are more likely to click on suspicious links or mail attachments, while the high volume of emails sent amongst students and staff using institutional addresses makes universities an ideal target for phishing campaigns. Social engineering methods — such as delivering malware via illegitimate Facebook and Twitter accounts — are especially effective at universities, due to these services’ more or less ubiquitous use among students.

Finally, the widespread integration of poorly secured Internet of Things (IoT) devices within universities facilitates even more avenues into the network. For instance, in 2017, attackers used readily available brute-forcing tools to exploit default passwords on more than 5,000 IOT devices at an undisclosed U.S. university, implementing these devices as part of a botnet to attack the university’s network. Incidents such as this not only wreak havoc on daily activity but also inflict lasting harm on a school’s reputation.

Turning the tide with AI

Rather than focusing on building perimeter walls around campus networks, security teams should instead concentrate on tracking and monitoring network devices, ensuring that they are immediately alerted whenever an incident occurs. Indeed, with such an expansive attack surface to safeguard, and so many poorly secured IoT and BYOD devices online at all times, attackers will inevitably breach network perimeters. The key, therefore, is to attain the ability to see inside the network, and ultimately, to neutralize attacks that have already infiltrated.

Unfortunately, this internal network visibility is where the traditional security tools employed by most universities are most limited. By searching only for known threats at the perimeter using fixed rules and signatures, conventional tools alone are likely to miss the next novel attack on the world’s universities — making it all the more imperative that these institutions learn their lesson before it’s too late. On the contrary, AI security systems learn to differentiate between normal and abnormal behavior for each user, device, and network, enabling them to autonomously detect and respond to the subtle anomalies that indicate an in-progress cyber-attack.

The primary goal of a university network is to provide highly accessible learning environments on the securest possible platform. Universities should embrace cyber AI to protect valuable research and IP, without impacting on the interconnectivity that we’ve come to expect on campus.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO

More in this series

No items found.

Blog

/

/

May 1, 2025

Your Vendors, Your Risk: Rethinking Third-Party Security in the Age of Supply Chain Attacks

man on cellphoneDefault blog imageDefault blog image

When most people hear the term supply chain attack, they often imagine a simple scenario: one organization is compromised, and that compromise is used as a springboard to attack another. This kind of lateral movement is common, and often the entry vector is as mundane and as dangerous as email.

Take, for instance, a situation where a trusted third-party vendor is breached. An attacker who gains access to their systems can then send malicious emails to your organization, emails that appear to come from a known and reputable source. Because the relationship is trusted, traditional phishing defenses may not be triggered, and recipients may be more inclined to engage with malicious content. From there, the attacker can establish a foothold, move laterally, escalate privileges, and launch a broader campaign.

This is one dimension of a supply chain cyber-attack, and it’s well understood in many security circles. But the risk doesn’t end there. In fact, it goes deeper, and it often hits the most important asset of all: your customers' data.

The risk beyond the inbox

What happens when customer data is shared with a third party for legitimate processing purposes for example billing, analytics, or customer service and that third party is then compromised?

In that case, your customer data is breached, even if your own systems were never touched. That’s the uncomfortable truth about modern cybersecurity: your risk is no longer confined to your own infrastructure. Every entity you share data with becomes an extension of your attack surface. Thus, we should rethink how we perceive responsibility.

It’s tempting to think that securing our environment is our job, and securing their environment is theirs. But if a breach of their environment results in the exposure of our customers, the accountability and reputational damage fall squarely on our shoulders.

The illusion of boundaries

In an era where digital operations are inherently interconnected, the lines of responsibility can blur quickly. Legally and ethically, organizations are still responsible for the data they collect even if that data is processed, stored, or analyzed by a third party. A customer whose data is leaked because of a vendor breach will almost certainly hold the original brand responsible, not the third-party processor they never heard of.

This is particularly important for industries that rely on extensive outsourcing and platform integrations (SaaS platforms, marketing tools, CRMs, analytics platforms, payment processors). The list of third-party vendors with access to customer data grows year over year. Each integration adds convenience, but also risk.

Encryption isn’t a silver bullet

One of the most common safeguards used in these data flows is encryption. Encrypting customer data in transit is a smart and necessary step, but it’s far from enough. Once data reaches the destination system, it typically needs to be decrypted for use. And the moment it is decrypted, it becomes vulnerable to a variety of attacks like ransomware, data exfiltration, privilege escalation, and more.

In other words, the question isn’t just is the data secure in transit? The more important question is how is it protected once it arrives?

A checklist for organizations evaluating third-parties

Given these risks, what should responsible organizations do when they need to share customer data with third parties?

Start by treating third-party security as an extension of your own security program. Here are some foundational controls that can make a difference:

Due diligence before engagement: Evaluate third-party vendors based on their security posture before signing any contracts. What certifications do they hold? What frameworks do they follow? What is their incident response capability?

Contractual security clauses: Build in specific security requirements into vendor contracts. These can include requirements for encryption standards, access control policies, and data handling protocols.

Third-party security assessments: Require vendors to provide evidence of their security controls. Independent audits, penetration test results, and SOC 2 reports can all provide useful insights.

Ongoing monitoring and attestations: Security isn’t static. Make sure vendors provide regular security attestations and reports. Where possible, schedule periodic reviews or audits, especially for vendors handling sensitive data.

Minimization and segmentation: Don’t send more data than necessary. Data minimization limits the exposure in the event of a breach. Segmentation, both within your environment and within vendor access levels, can further reduce risk.

Incident response planning: Ensure you have a playbook for handling third-party incidents, and that vendors do as well. Coordination in the event of a breach should be clear and rapid.

The human factor: Customers and communication

There’s another angle to supply chain cyber-attacks that’s easy to overlook: the post-breach exploitation of public knowledge. When a breach involving customer data hits the news, it doesn’t take long for cybercriminals to jump on the opportunity.

Attackers can craft phishing emails that appear to be follow-ups from the affected organization: “Click here to reset your password,” “Confirm your details due to the breach,” etc.

A breach doesn’t just put customer data at risk it also opens the door to further fraud, identity theft, and financial loss through social engineering. This is why post-breach communication and phishing mitigation strategies are valuable components of an incident response strategy.

Securing what matters most

Ultimately, protecting against supply chain cyber-attacks isn’t just about safeguarding your own perimeter. It’s about defending the integrity of your customers’ data, wherever it goes. When customer data is entrusted to you, the duty of care doesn’t end at your firewall.

Relying on vendors to “do their part” is not enough. True due diligence means verifying, validating, and continuously monitoring those extended attack surfaces. It means designing controls that assume failure is possible, and planning accordingly.

In today’s threat landscape, cybersecurity is no longer just a technical discipline. It’s a trust-building exercise. Your customers expect you to protect their information, and rightly so. And when a supply chain attack happens, whether the breach originated with you or your partner, the damage lands in the same place: your brand, your customers, your responsibility.

[related-resource]

Continue reading
About the author
Tony Jarvis
VP, Field CISO

Blog

/

/

April 30, 2025

Boosting Security with Azure Virtual Network TAP Traffic Mirroring

Man sitting at computerDefault blog imageDefault blog image

We are thrilled to announce that Darktrace is a launch partner for the Public Preview of Microsoft Azure Virtual Network Terminal Access Point (TAP). As Microsoft's 2024 UK Partner of the Year, we continue to innovate alongside Microsoft to deliver proactive cyber protection tailored to every organization.

Enhanced Defense Across the Modern Network

Modern networks are expanding far beyond on-premises into virtual environments, cloud and hybrid networks. More than 50% of incidents will come from cloud network activity by 2029, meaning defenders need a solution that can level the playing field against complex attacks that traverse multiple areas of a digital estate, including north-south and east-west traffic.

With Azure Virtual Network TAP, Darktrace’s self-learning AI gains seamless access to granular packet data in hybrid environments. This integration helps our Cyber AI platform build a comprehensive understanding of a customers’ Azure network. Microsoft's recent enhancement allows Virtual Network TAP to mirror the full throughput of VMs without impacting VM bandwidth, enabling agentless Cyber AI defense across these instances.

Darktrace's Cyber AI provides real-time visibility and adaptive, autonomous defense for your Microsoft security strategy. Our platform continuously learns the normal behavior of every user, device, and workload in your environment. This deep understanding of usual 'patterns of life' enables Darktrace to detect subtle deviations that indicate threats, from account takeovers to critical misconfigurations.

Our bespoke, real-time knowledge of usual activity allows Darktrace to identify unknown and unpredictable threats that bypass policy-based defenses—without relying on rules, signatures, or prior assumptions. This approach is a powerful compliment to Microsoft’s unprecedented threat intelligence.

Expanding Azure Virtual Network TAP

Azure Virtual Network TAP allows continuous streaming of virtual machine network traffic, which customers can leverage for Darktrace’s AI-driven threat detection and investigation. Darktrace / NETWORK passively ingests traffic from on-premises, virtual, cloud, hybrid environments, and remote devices, analyzing both encrypted and decrypted packets to uncover unusual activity in real-time. Unlike other NDR vendors that process data in the cloud, our industry-leading Self-Learning AI is deployed locally and trained solely on your data, ensuring tailored security outcomes without compromising privacy.

Benefits to Darktrace Customers

Darktrace customers will experience enhanced security through deeper insights into network traffic, enabling more accurate threat detection and response. The ability to mirror full VM throughput without affecting bandwidth ensures optimal performance, while agentless defense reduces barrier to entry and simplifies management. Customers benefit from proactive protection by continuously monitoring and analyzing traffic to identify and mitigate threats before they cause harm. Additionally, seamless integration with existing Azure environments leverages the power of Darktrace’s AI for enhanced security.

[related-resource]

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI