Cybercriminals are increasingly targeting the education sector, according to a recent threat report by Barracuda Networks.

Researchers at Barracuda have detected a new wave of spear-phishing attacks targeting the education sector as students are compelled to learn from home amid Covid-19.

Also read: One-third of Indian IT managers feel ‘significantly behind’ in understanding cyber threats: Report

“Spear phishing is a personalised phishing attack that targets a specific organisation or individual. Over the years, cybercriminals have rapidly evolved and continue to adopt more innovative styles of attacks against different sectors, including education,” the cloud security firm explained in an official release.

The researchers evaluated more than 3.5 million spear-phishing attacks executed on various sectors. This included phishing attacks targeted solely at the education sector. The report stated that over 1,000 schools, colleges, and universities were attacked as part of spear phishing campaigns between June and September.

Email, preferred method

Email is one of the most preferred method of such scammers. According to th report, email scams and service impersonation against schools were the most common types of cyberattacks during this period.

Also read: Now, looming spectre of a digital pandemic

Threat actors also resorted to another form of cyberattack called business email compromise (BEC) attack. BEC attacks dropped 10-14 per cent between July and August when educational institutions are usually closed for vacation. However, these attacks began to spike in September as institutions began to start operations.

Furthermore, a majority of BEC attacks were launched through Gmail accounts.

“Gmail accounts were the primary medium for cybercriminals to launch the aforementioned attacks – accounting for 86 per cent of all BEC attacks on the education sector,” the report said.

“Cybercriminals prefer to use well-known email providers like Gmail because they are free, easy to register, and have a higher reputation in the market. They customised malicious email addresses using terms like ‘principal’, ‘head of department’, ‘school’, and ‘president’ to make them look realistic,” it said.

Attackers leveraged urgent looking subject lines to further trick the victims. Some examples of these subject lines include, “‘Covid-19 New Updates, Covid-19 School Meeting, COVID-19 Update, and Follow Up Right Now, among others.’

According to Barracuda’s analysis, out of the total number of malicious messages detected (both inbound and outbound), 1 in 4 messages was sent from internal email accounts. In the education sector, with 57 per cent of infectious emails sent from internal accounts.

Students vulnerable, too

Murali Urs, Country Manager-India, Barracuda Networks, said, “As schools and colleges continue to teach students remotely, it makes both the parties vulnerable to cyberattacks. Spear phishing has many forms as we saw in our latest threat report. While online teaching and learning is a crucial part of the new normal, it is also important for students and teachers to act mindfully before, during and post the online classes.

“Neither every system has an updated antivirus protection, nor everyone is aware of how to respond to these attacks. Investing in the right cybersecurity solutions along with gaining proper knowledge on prevention methods is, therefore, the need of the hour.”