UT San Antonio Cyber Incident: Higher-Ed IR Playbook for Registration and Payment System Outages

The University of Texas at San Antonio (UTSA) has taken IT systems offline following a cyber incident, disrupting student registration and tuition payment processing — with the timing couldn't-be-worse reality that the spring term is days away from resuming. According to reporting from Infosecurity Magazine, the outage has directly impacted core student-facing services, forcing the university to triage restoration while students face enrollment and payment deadlines.

I've led IR engagements at universities, and the pattern here is one defenders in higher education know well: threat actors deliberately time intrusions against the academic calendar. Term-start weeks, tuition deadlines, and holiday breaks are when IT staffing is thinnest, when financial pressure to restore services is highest, and when ransom leverage is maximized. Whether this incident ultimately proves to be ransomware, a destructive intrusion, or a precautionary shutdown after detecting suspicious activity, the defensive playbook is the same — and every university, community college, and K-12 district reading this should treat UTSA's outage as a live tabletop exercise for their own environment.

No CVE has been attributed to this incident, and no threat actor has claimed responsibility as of this writing. This post focuses on what defenders can do right now: detecting the precursor behaviors that precede forced system shutdowns, hunting for the most common intrusion TTPs in education-sector incidents, and hardening the exact systems — student information systems (SIS), payment portals, and identity infrastructure — that attackers target.

Technical Analysis

What We Know

• Target: University of Texas at San Antonio — a large public research university with ~35,000 students
• Impact: IT systems taken offline; student registration and tuition payment processing disrupted
• Timing: Days before the term resumes — a classic pressure-window attack pattern
• Response posture: UTSA proactively took systems offline, which suggests either (a) detection of active malicious activity requiring containment, or (b) confirmed compromise of infrastructure critical enough to warrant a precautionary shutdown

The Higher-Ed Threat Model

Education remains one of the most-attacked sectors globally for three structural reasons:

1. Sprawling, heterogeneous environments. Universities run everything from modern cloud SaaS to decade-old Banner/PeopleSoft SIS instances, research HPC clusters, and legacy building-management systems — often on flat networks designed for academic openness, not segmentation.
2. Identity chaos. Tens of thousands of accounts with high turnover (enrollment, graduation, adjunct faculty), frequent password resets at term start, and historically inconsistent MFA enforcement.
3. Financial data concentration. Tuition payment portals touch PCI-DSS-scoped cardholder data, and SIS platforms hold PII subject to FERPA — making universities dual-purpose targets for both extortion and data theft.

Likely Attack Chain (Defender's Perspective)

Without confirmed attribution, the highest-probability intrusion paths for a disruption of this scale in higher education are:

1. Initial access via compromised credentials or phished SSO sessions — education-sector phishing spikes sharply in the weeks before term start, themed around registration, financial aid, and password expiration lures.
2. Initial access via internet-facing remote access infrastructure — VPN concentrators, RDP gateways, and remote management appliances remain the top intrusion vector in the education incidents I've responded to.
3. Privilege escalation and lateral movement toward identity infrastructure (Active Directory, Entra ID sync servers) and the SIS/ERP tier.
4. Impact staging — mass encryption preparation, shadow copy deletion, backup targeting, or destructive wiper activity — which is typically the moment a university detects the intrusion and pulls systems offline, exactly as UTSA has done.

The fact that UTSA took systems offline rather than discovering them already encrypted is a meaningful detail: it suggests the security team caught the intrusion during or before the impact phase. That is the detection window every defender should be engineering for.

Exploitation Status

No CVE, malware family, or threat actor has been publicly attributed. No CISA KEV entry applies. Treat this as an active incident-response scenario and apply the behavioral detections below rather than waiting for IOCs that may never be published.

Detection & Response

The detections below target the observable behaviors that precede forced shutdowns in education-sector intrusions: backup/shadow-copy destruction, mass service termination, and anomalous authentication against identity and remote access infrastructure. These are tuned to fire on high-fidelity precursor behavior, not ambient noise.

Sigma Rules

---
title: Shadow Copy Deletion via Administrative Tools
tid: 8f2b3c41-6a1e-4d92-b7c4-9e1f0a3d5b72
status: experimental
description: Detects deletion of volume shadow copies and backup catalog tampering, a common ransomware precursor behavior observed before mass impact in education-sector incidents.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.infosecurity-magazine.com/news/cyber-incident-ut-san-antonio/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance windows (rare; verify against change tickets)
level: high
---
title: Mass Service Termination Targeting Backup and Security Services
tid: 3d7a9f15-2b8c-4e61-a4d3-5c9b1e8f2a06
status: experimental
description: Detects net.exe, sc.exe, or taskkill used to stop backup, database, or security services in bulk — a hallmark of ransomware staging before encryption of SIS/ERP servers.
references:
  - https://attack.mitre.org/techniques/T1489/
  - https://attack.mitre.org/techniques/T1562.001/
  - https://www.infosecurity-magazine.com/news/cyber-incident-ut-san-antonio/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.impact
  - attack.t1489
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
      - '\taskkill.exe'
  selection_target:
    CommandLine|contains:
      - 'stop "SQL'
      - 'stop MSSQL'
      - 'stop Veeam'
      - 'stop "Backup'
      - 'stop "Backup Exec'
      - 'stop "Veritas'
      - 'stop "Commvault'
      - 'stop "Windows Defender'
      - 'stop "Sophos'
      - 'stop "SentinelAgent'
      - 'stop "CrowdStrike'
  condition: all of selection_*
falsepositives:
  - Scripted service restarts by backup administrators (whitelist known admin hosts and service accounts)
level: high
---
title: Impossible Travel or MFA Fatigue Pattern on SSO Authentication
tid: 61c4e2a8-9f37-4b15-8d62-1a7f3c0e5b94
status: experimental
description: Detects authentication anomalies consistent with credential-based initial access against university SSO portals — a frequent entry point before term-start outages.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1621/
  - https://www.infosecurity-magazine.com/news/cyber-incident-ut-san-antonio/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.initial_access
  - attack.t1078
  - attack.credential_access
  - attack.t1621
logsource:
  category: authentication
  product: azure
detection:
  selection:
    OperationName:
      - 'Sign-in activity'
    ResultType: 0
    RiskLevelDuringSignIn:
      - 'high'
      - 'medium'
  filter_managed_devices:
    IsCompliantDevice: true
  condition: selection and not filter_managed_devices
falsepositives:
  - Students traveling internationally between terms — validate against enrollment records before escalation
level: medium

KQL — Microsoft Sentinel / Defender Hunt

This query hunts the combined impact-staging pattern across your Windows estate: shadow copy tampering and mass service stops within a tight time window — the behavior that typically triggers the kind of precautionary shutdown UTSA executed. It also surfaces anomalous sign-in volume against remote access portals, which you should correlate with your VPN/SSO logs ingested via CEF/Syslog.

// Hunt: Ransomware impact-staging behaviors (shadow copy deletion + service stops)
let Lookback = 7d;
let SuspiciousProcs = dynamic(["vssadmin.exe","bcdedit.exe","wbadmin.exe","wmic.exe"]);
let ShadowTamper = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (SuspiciousProcs)
| where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","delete catalog","bootstatuspolicy ignoreallfailures")
| project TamperTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let ServiceStops = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("net.exe","net1.exe","sc.exe","taskkill.exe")
| where ProcessCommandLine has_any ("stop","/delete")
| summarize StopCount=count(), StoppedTargets=make_set(ProcessCommandLine, 20) by DeviceName, AccountName, bin(TimeGenerated, 15m)
| where StopCount >= 5;
ShadowTamper
| join kind=inner (ServiceStops) on DeviceName
| project DeviceName, AccountName, TamperTime, StopCount, StoppedTargets, FileName, ProcessCommandLine
| order by TamperTime desc;
// Secondary: anomalous failed-then-successful auth on VPN/SSO gateways (CEF/Syslog ingestion)
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor has_any ("Palo Alto","Fortinet","Cisco","Citrix","F5")
| summarize FailedCount=countif(Message has "failed" or Message has "denied"), SuccessCount=countif(Message has "success" or Message has "allowed") by SourceIP, DestinationUserName, bin(TimeGenerated, 1h)
| where FailedCount >= 10 and SuccessCount >= 1
| order by FailedCount desc;

Velociraptor VQL Hunt

Deploy this as a hunt across Windows servers hosting SIS, ERP, and payment-tier workloads to catch impact-staging processes and recently created persistence artifacts in one pass.

-- Hunt: Impact-staging processes and recent persistence on critical servers
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|delete catalog|stop.*(sql|veeam|backup|defender|sophos|crowdstrike))'
   OR Exe =~ '(?i)(vssadmin|bcdedit|wbadmin)\.exe$'

-- Correlate with recently modified Run keys and scheduled tasks (persistence check)
SELECT Name, Data, ModificationTime
FROM glob(globs='HKLM:/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*', accessor='registry')
WHERE ModificationTime > now() - 604800

Remediation & Hardening Script

Run this from an elevated prompt on domain controllers and critical servers during your readiness check. It verifies backup integrity signals, confirms shadow copies are enabled, and audits for unauthorized local admins — the three fastest validation checks before term-start operations resume.

# Verify VSS is healthy and shadow copies exist on critical volumes
Get-Service VSS | Select-Object Name, Status, StartType
vssadmin list shadows
vssadmin list writers | Select-String -Pattern "State|Last error"

# Audit local Administrators for unauthorized additions in the last 30 days
Get-LocalGroupMember -Group "Administrators" | Select-Object Name, ObjectClass, PrincipalSource
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Where-Object {$_.Message -match 'Administrators'} |
  Select-Object TimeCreated, Message

# Confirm MFA enforcement on remote access: list accounts without enforced MFA (AD-side proxy check)
Get-ADUser -Filter {Enabled -eq $true} -Properties lastLogonTimestamp, PasswordNeverExpires |
  Where-Object {$_.PasswordNeverExpires -eq $true} |
  Select-Object SamAccountName, PasswordNeverExpires

# Verify SMB signing and disable legacy SMBv1 on servers (lateral movement hardening)
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignature, EnableSecuritySignature
Set-SmbServerConfiguration -EnableSMB1Protocol $false -RequireSecuritySignature $true -Confirm:$false

# Export recent 4625 (failed logon) spikes for brute-force review
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} |
  Group-Object {$_.Properties[19].Value} |
  Sort-Object Count -Descending | Select-Object -First 20 Name, Count

Remediation

Since no CVE or specific vendor patch applies to this incident, remediation is architectural and operational. Prioritize in this order:

Immediate (24-72 hours):

1. Enforce phishing-resistant MFA on all remote access and SSO — VPN concentrators, SIS admin consoles, and payment portal administrative interfaces. This is the single highest-leverage control against education-sector intrusions.
2. Isolate and verify backups. Confirm backups of SIS databases, AD, and payment systems are offline/immutable, and perform a test restore. Attackers target backup infrastructure first — assume your backup credentials are compromised until proven otherwise.
3. Reset credentials for privileged and service accounts, prioritizing accounts with access to identity infrastructure, backup systems, and the SIS/ERP tier.
4. Audit remote access exposure. Inventory all internet-facing VPN, RDP, and remote management interfaces; disable anything not business-critical through term start.

Short-term (1-2 weeks): 5. Segment the SIS and payment tier. Student information systems and PCI-scoped payment processing should sit behind dedicated firewall policy with deny-by-default east-west rules — an attacker who lands on a student workstation should never reach Banner/Ellucian/PeopleSoft directly. 6. Deploy the detections above into your SIEM and validate them against a controlled test (e.g., run vssadmin list shadows to confirm telemetry pipelines work, then test with an isolated simulation). 7. Build a term-start surge playbook. Pre-stage IR retainers, out-of-band communications trees (assume email is down), and manual registration/payment contingencies for the first two weeks of each term.

Structural (this quarter): 8. Compliance alignment. If payment card data was potentially exposed, engage your QSA and review PCI-DSS incident response obligations immediately. For student records, evaluate FERPA and state breach-notification timelines now, not after forensics conclude — notification clocks start at determination, not at convenience. 9. Adopt NIST CSF 2.0 and CIS Controls IG2 as your baseline. The incidents I've seen cripple universities almost always trace back to IG1 gaps: unmanaged assets, unpatched remote access, and no offline backups.

Communication discipline: UTSA's situation also illustrates a lesson I drill into every IR client — your students, faculty, and local media are a stakeholder audience. Pre-draft outage communications templates and establish a status page hosted on infrastructure outside your primary environment. When your SIS is down, your ability to tell 35,000 students what to do next is itself a resilience control.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub