Two Students

Profile narrative

The threat actor known as Two Students consists of two individuals identified in reporting as Chen and Zhang, who were enrolled as college students in Shanghai’s Songjiang District. They operated under the alias Two Students in public accounts of their activity. Their known location is China, specifically the Shanghai area. No further personal details beyond their student status and names are provided in the source. The alias reflects the limited public description of the pair as a duo rather than a named group.

The actor’s activity was directed at the education sector, targeting a college website that stored students’ physical education scores. The geographic focus of the operation was the Shanghai region within China. Their objective was financial gain, as they charged peers a fee for each grade alteration they performed. Reports indicate they charged between 15 yuan (approximately $2.4) and 20 yuan (approximately $3.2) per modification. A total of approximately 200 students used their services, generating roughly 80,000 yuan in revenue.

Technical details described in the report indicate that the actors exploited a security hole in the college’s website to gain unauthorized access to its backend database. Once inside, they altered the recorded scores for physical education classes. No specific malware families, exploit kits, or custom tooling are mentioned in the source material. The activity relied on leveraging a web‑application vulnerability rather than deploying malicious code. The method involved direct manipulation of data stored in the school’s online grade‑management system.

Attribution to any state‑sponsored group or criminal consortium is not established in the reporting; the actors are presented as independent students. Following the discovery of the altered grades by the school administration, the security flaw was patched and law‑enforcement was involved, leading to the arrest of Chen and Zhang. The case is cited as an example of financially motivated grade‑changing schemes that have appeared in other jurisdictions, such as the Miami high‑school incident noted in the same article. The school reported noticing the unauthorized changes in March and subsequently fixing the vulnerability. The information presented reflects only what is documented in the source article.

Incidents

Attributed incidents are available to members.