Cyber Threat Actor: MarxistAttorney

MarxistAttorney is a threat actor primarily targeting universities, with confirmed operations between 2014 and 2015. The actor used the alias @MarxistAttorney and interacted with or referenced the Carbonic collective (also identified as #TeamCarbonic in early reports), though no formal organizational affiliation was explicitly established. Their operations focused exclusively on educational institutions, including the University of Chicago, University of Hawaii, Cornell University, University of Maryland, and Abertay University (UK), among others. Strategic objectives included publicizing stolen data to embarrass institutional IT departments and protesting tuition fees, as stated directly by the actor. MarxistAttorney claimed personal motivation as a debt-burdened student seeking to highlight financial inequities in higher education, though operations also cited pursuing "lulz" (amusement) through disruptive actions.

The actor consistently exploited SQL injection (SQLi) vulnerabilities to compromise university web servers, as demonstrated in breaches at the University of Chicago Biological Sciences Department and University of Hawaii. Compromised data included payroll statuses, employee IDs, device MAC addresses, service tags, and non-sensitive contact information. MarxistAttorney selectively exfiltrated and published subsets of stolen data—such as salary activation statuses from the University of Chicago and utility account details from Cornell—while claiming to withhold more sensitive materials like patient records out of ethical concerns. Public disclosures occurred via Pastebin and mirrored datasets, often accompanied by taunting messages criticizing institutional security practices. No malware use, state sponsorship, or financial monetization was referenced in reporting. Key operations included the University of Chicago breach involving MSSQL Server data and the multi-university campaign spanning at least eight institutions, with victim confirmation from Abertay University regarding a compromised satellite site.