# Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk

> Akamai reports the U.S. accounts for 33% of the 104 education-sector attacks recorded worldwide. Public incidents in 2026 include an Interlock ransomware attack on Community College of Beaver County (March), the ShinyHunters extortion breach of Instructure Canvas (April-May), and a cyberattack on Springfield Public Schools (September) later claimed by Interlock. Akamai also flags browser-based AI tool data exposure, custom-AI API exposure and agentic AI/RAG pipeline risk.

- **Published:** 2026-11-05T16:06:41Z
- **Last reviewed:** 2026-11-05T16:06:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5329
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5329.png
- **ID:** TL-2026-5329
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Interlock
- **Detections:** 9 (1 shown free below) · **IOCs:** 21

## Description

This record documents sector-level threat activity against education institutions, anchored on an Akamai Security Blog article (Erin Verna, 2026-11-05) that cites three 2026 incidents and does not itself name any ransomware group, malware family or IOC. Attribution and technical detail below come from third-party reporting and are labeled by source.

Community College of Beaver County (CCBC, PA): the college disclosed on 2026-03-09 that attackers encrypted data and disrupted access to grades, transcripts and financial records as it entered spring break; the campus closed and in-person classes resumed 2026-03-30. Interlock, a ransomware operation active since October 2024, later listed CCBC on its leak site claiming 780 GB of data. Comparitech notes the claim is unverified by CCBC and the intrusion method, ransom amount and whether a ransom was paid are unknown.

Instructure Canvas: Instructure reported unauthorized access beginning 2026-04-25, detected on 2026-04-29 and disclosed 2026-05-01. ShinyHunters, an extortion group, was reported to have abused the Free-For-Teacher account program. Reported exposure covers names, email addresses, student IDs and private messages (not passwords, birth dates, government IDs or financial data), with figures of roughly 3.65 TB and ~275 million accounts across ~8,800-9,000 institutions. A second compromise on 2026-05-07 replaced the Canvas login page with a ransom message, and on 2026-05-11 Instructure said it reached an agreement with ShinyHunters and received confirmation of data destruction (unconfirmed press reports cite a ~$10 million payment). This was data-theft extortion rather than file-encrypting ransomware. A class action was filed 2026-05-13 and the House Homeland Security Committee requested a briefing.

Springfield Public Schools (MA): all schools closed from 2026-09-08 after a 'Level 4' cyber incident; the FBI later said student and staff data was breached, possibly including Social Security numbers. On 2026-09-15 Interlock was reported to have claimed the attack (single secondary source; data types claimed include student records, employee data, phone records and medical information).

Interlock TTPs (CISA/FBI joint advisory AA25-203A, July 2025, general to the group and not confirmed for these specific victims): initial access by drive-by download from compromised legitimate sites and ClickFix/FileFix social engineering (fake CAPTCHA, paste-and-run PowerShell); execution of PowerShell, persistence via a disguised 'Chrome Updater' registry run entry, credential theft (Lumma and Berserk stealers, a keylogger klg.dll, Kerberoasting), lateral movement over RDP with AnyDesk and PuTTY, exfiltration through Azure Storage Explorer, AzCopy and WinSCP, Cobalt Strike, SystemBC and NodeSnake/Interlock RATs, and encryption appending .interlock (also .1nt3rlock) with a !__README__!.txt note.

Akamai attributes education exposure to known weaknesses (broken authentication, exposed APIs, phishing, credential theft), decentralized campus networks, and uncontrolled AI tool use (browser-based AI uploads of research data and student records, API data exchange by custom AI apps, agentic AI/RAG pipelines). Stated mitigations: Zero Trust microsegmentation, ZTNA, browser-level DLP for AI use, API security and documented controls for cyber insurance; compliance references are FERPA and OWASP Top 10 (broken access control). No network IOCs (IPs/domains/hashes) were published in any source reviewed, so no BeaconBeagle correlation was possible.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Interlock ClickFix/FileFix Paste-and-Run PowerShell Launched from Explorer** (`TL-2026-5329-SPL-001`)

Detects the Interlock ransomware initial-access pattern (CISA AA25-203A, TL-2026-5329). A victim pastes a fake-CAPTCHA command into the Windows Run dialog or File Explorer address bar, so powershell.exe, pwsh.exe or mshta.exe is spawned directly by explorer.exe with a hidden window, encoded command or download cradle. The download_cradle flag marks second-stage retrieval (ingress tool transfer). Maps to T1204.004, T1059.001 and T1105.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1105
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe") (CommandLine="*-w hidden*" OR CommandLine="*-windowstyle hidden*" OR CommandLine="*-enc *" OR CommandLine="*-encodedcommand*" OR CommandLine="*downloadstring*" OR CommandLine="*invoke-expression*" OR CommandLine="*invoke-webrequest*" OR CommandLine="*invoke-restmethod*" OR CommandLine="*iex *" OR CommandLine="*iex(*" OR CommandLine="*irm *")
| eval download_cradle=if(match(lower(CommandLine),"(downloadstring|downloadfile|invoke-webrequest|invoke-restmethod|\\biwr\\b|\\birm\\b|net\\.webclient)"),"yes","no")
| stats count min(_time) as first_seen max(_time) as last_seen max(download_cradle) as download_cradle values(CommandLine) as detail by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe")
| where ProcessCommandLine has_any ("-w hidden", "-windowstyle hidden", "-enc ", "-encodedcommand", "downloadstring", "invoke-expression", "invoke-webrequest", "invoke-restmethod", "iex ", "iex(", "irm ")
| extend DownloadCradle = ProcessCommandLine has_any ("downloadstring", "downloadfile", "invoke-webrequest", "invoke-restmethod", "irm ", "net.webclient")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DownloadCradle, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Interlock ClickFix FileFix Paste-and-Run PowerShell Launched from Explorer
id: 3b1f6c52-8a4e-4d17-9c0b-5e2a7d4f1a01
status: experimental
description: Detects PowerShell, pwsh or mshta spawned directly by explorer.exe with hidden-window, encoded-command or download-cradle arguments, the ClickFix and FileFix paste-and-run pattern (fake CAPTCHA pasted into the Run dialog or File Explorer address bar) used by Interlock ransomware for initial access (TL-2026-5329)
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
    - https://blog.talosintelligence.com/emerging-interlock-ransomware/
    - https://www.bleepingcomputer.com/news/security/interlock-ransomware-adopts-filefix-method-to-deliver-malware/
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
    selection_cli:
        CommandLine|contains:
            - '-w hidden'
            - '-windowstyle hidden'
            - '-enc '
            - '-encodedcommand'
            - 'downloadstring'
            - 'invoke-expression'
            - 'invoke-webrequest'
            - 'invoke-restmethod'
            - 'iex '
            - 'iex('
            - 'irm '
    condition: selection_parent and selection_image and selection_cli
falsepositives:
    - Administrators or help-desk staff launching hidden or encoded PowerShell from Explorer-driven shortcuts or login scripts
    - Software deployment shortcuts that start PowerShell with -WindowStyle Hidden from the desktop
level: high

```

**Known false positives:**

- Administrators or help-desk staff launching hidden or encoded PowerShell from Explorer-driven shortcuts or login scripts
- Software deployment shortcuts that start PowerShell with -WindowStyle Hidden from the desktop

**Tuning notes:** Exclude known-good signed deployment scripts by command-line hash or path and allowlist admin workstations. Add a prevalence filter (rare command line per host) to cut noise. Prioritise rows where download_cradle=yes. Pair with RunMRU registry monitoring (see KQL-001).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Interlock Fake-CAPTCHA ClickFix Markers in Command Lines and RunMRU (locked: unlock with TL Creds)
- Interlock Credential Theft: Keylogger [indicator] and Browser Credential Store Access (locked: unlock with TL Creds)
- Interlock Data Exfiltration Tooling: AzCopy, Azure Storage Explorer and WinSCP to Cloud Storage (locked: unlock with TL Creds)
- Interlock Kerberoasting: PowerShell Ticket Requests and RC4 Service-Ticket Bursts (locked: unlock with TL Creds)
- Interlock Ransomware Artifacts: Encrypted Extensions, Ransom Note, [indicator] and [indicator] (locked: unlock with TL Creds)
- Connection to Community-Reported Cobalt Strike and Interlock-Related Infrastructure (locked: unlock with TL Creds)
- Interlock '[indicator]' Disguised Logon Run Key Persistence (locked: unlock with TL Creds)
- Interlock Lateral Movement via Remote Access Tools (AnyDesk, PuTTY) Correlated with RDP Logons (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Why Higher Ed Needs a New Playbook for Ransomware, AI Risk, and Compliance (Akamai, Erin Verna)](https://www.akamai.com/blog/security/2026/nov/higher-ed-needs-new-playbook-ransomware-ai-risk-compliance)
- [Cybercriminals say they hacked a Pennsylvania community college (Comparitech)](https://www.comparitech.com/news/cybercriminals-say-they-hacked-community-college-of-beaver-county)
- [CBS News Pittsburgh: Community College of Beaver County cyberattack](https://www.cbsnews.com/pittsburgh/news/community-college-of-beaver-county-cyberattack)
- [2026 Canvas data breach (Wikipedia)](https://en.wikipedia.org/wiki/2026_Canvas_data_breach)
- [Instructure Canvas breach, May 2026 (University of Memphis ITS)](https://www.memphis.edu/its/security/instructure-canvas-breach-may-2026.php)
- [Deconstructing the Canvas (Instructure) Data Breach (JD Supra)](https://www.jdsupra.com/legalnews/deconstructing-the-canvas-instructure-2612365/)
- [Springfield, Massachusetts schools cyber attack: student and staff data (WBUR)](https://www.wbur.org/news/2026/09/16/springfield-massachusetts-schools-cyber-attack-student-staff-data)
- [FBI: Springfield school cyber attack included data breach, maybe Social Security numbers (GBH)](https://www.wgbh.org/news/local/2026-09-16/fbi-to-springfield-school-cyber-attack-included-data-breach-maybe-social-security-numbers)
- [Interlock Strikes Springfield Public Schools in Major Ransomware Attack (DeXpose)](https://www.dexpose.io/interlock-strikes-springfield-public-schools-in-major-ransomware-attack/)
- [#StopRansomware: Interlock (CISA AA25-203A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a)
- [Interlock Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA25-203A (Picus Security)](https://www.picussecurity.com/resource/blog/cisa-alert-aa25-203a-interlock-ransomware-analysis)
- [Emerging Interlock ransomware (Cisco Talos)](https://blog.talosintelligence.com/emerging-interlock-ransomware/)
- [Interlock ransomware adopts FileFix method to deliver malware (BleepingComputer)](https://www.bleepingcomputer.com/news/security/interlock-ransomware-adopts-filefix-method-to-deliver-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5329