On 2024-09-01, Blackpoint's MDR+R technology and Active SOC team stopped a threat actor attempting to use Classroom Spy Pro within an Institutions and Organizations partner's environment.
Blackpoint's MDR+R technology detected multiple RDP connections and remote executions from a gateway of an Institutions & Organizations partner.
Initial investigation by the Active SOC found Classroom Spy Pro, an institutional spyware program, running on a machine.
Additional analysis discovered an SSL VPN connection made by a user account, as well as additional machines that had the spy software pushed to them remotely.
Active SOC analysts isolated all affected machines and disconnected the VPN connection before reaching out to the Institutions & Organizations partner with additional details and remediation advice.