An analysis of incidents at Brazilian educational institutions

This report details cyberattacks targeting educational institutions in Brazil since 2025, highlighting a trend of leveraging readily available tools and valid accounts to gain access and deploy ransomware and other malware. The majority of incidents involved private institutions, with ransomware attacks being the most prevalent. The analysis reveals a reliance on techniques like stolen credentials, remote access tools (AnyDesk, PsExec), and legacy operating systems, alongside a significant number of incidents stemming from insider threats utilizing keyloggers. The report emphasizes the need for enhanced security measures, including multi-factor authentication, strict account management, and improved forensic visibility.