Universities and colleges around the world are being targeted by a new phishing campaign, according to fresh research published by RiskIQ.

Among the educational establishments to be hit by the Shadow Academy campaign are Louisiana State University (LSU) in the United States and Oxford, Brighton, and Wolverhampton Universities in the United Kingdom.

RiskIQ researchers got wind of Shadow Academy threat actors’ malicious activity at the beginning of July 2020, when it showed up on their internet intelligence graph. 

By tracking the campaign from July to October 2020, researchers uncovered 20 unique targets in Australia, Afghanistan, the UK, and the USA.  

According to researchers, the tactics, techniques, and procedures (TTPs) used across the campaign’s attack were “similar” to those deployed by the Mabna Institute, an Iranian company that, according to the FBI, was created for illegally gaining access “to non-Iranian scientific resources through computer intrusions.” 

Researchers found that 63% of the universities were targeted with general access or student portal attacks, 37% were targeted with library-themed attacks, and 11% of the universities were hit with attacks themed around financial aid.

LSU, which suffered a student portal domain shadowing attack, was the first target identified by RiskIQ crawl data. 

“Domain shadowing intercepts account traffic flowing to existing, registered, and otherwise trustworthy web domains,” wrote researchers. 

“First, threat actors steal domain account credentials. They then register unauthorized subdomains to point traffic to malicious servers or, in this case, create phishing pages.”

Researchers discovered that Shadow Academy had hosted similar malicious infrastructure to orchestrate attacks against three other universities. 

“RiskIQ’s internet intelligence graph helped unearth a new batch of compromised domains by keying in on the URL structure and date range of registration,” noted researchers. 

“Subdomains created from these domains spanned multiple campaign themes, which focused primarily on credential harvesting and financial theft.” 

The credential-harvesting URLs detected by researchers were mainly focused on services like Amazon, Instagram, and online banking. 

Researchers believe the timing of the campaign’s launch was chosen to coincide with the July release of timelines for on-campus operations by many college campuses.

South Africa–based financial services group Absa has stated that one of its employees sold the personal information of 200,000 clients to third parties.

The group confirmed on Wednesday that the illegal activity had occurred and that 2% of Absa’s retail customer base had been impacted. 

The employee allegedly responsible for it was a credit analyst who had access to the group’s risk-modeling processes. 

Data exposed as a result of the security incident included clients’ ID numbers, addresses, contact details, and descriptions of vehicles that they had purchased on finance. 

Financial details including PIN codes and passwords were not compromised by the data theft.

In an interview with ENCA, Absa group chief security officer Sandro Bucchianeri said that the employee believed to be behind the data theft was someone whom “we trusted” and who “had access to the information as part of their day job.”  

The analyst, who Bucchianeri said is now facing “broad criminal charges,” has been suspended while the matter is investigated further. 

Bucchianeri added that the parties who allegedly purchased the data from the analyst may use it to “try to commit fraud on these accounts.”

The data breach was discovered on October 27; however, Absa waited a month before revealing that client information had been compromised. Bucchianeri said that the delay was a deliberate move to ensure that “court processes” were not jeopardized.

After discovering that a breach had occurred, Absa obtained court orders for search and seizure operations to be carried out at “various premises.” 

The bank told Business Insider South Africa that all devices containing the stolen customer data had been found and wiped clean of the information. 

The incident at Absa follows the August theft of personal details belonging to 24 million South Africans and nearly 800,000 businesses from Experian in what was one of South Africa’s largest ever data breaches. Information swiped in the breach included names, ID numbers, telephone numbers, addresses, and email addresses.

Customers of Absa, Capitec, Standard Bank, Nedbank, and First National Bank were affected by the incident.