Students seeking to cheat

Profile narrative

The threat actor known as "Students seeking to cheat" operates within the United Kingdom, targeting educational institutions and examination systems to facilitate academic dishonesty. This group compromises school email systems and exam board networks to steal authentic national examination papers, which are subsequently sold to students attempting to gain unfair advantages. Their activities focus on high-stakes qualifications such as GCSEs and A-Levels administered by major British exam boards, including OCR, Pearson Edexcel, and AQA. The primary strategic objective appears financially motivated through the illicit sale of stolen materials, though the operation also undermines academic integrity on a systemic level. Law enforcement investigations involving multiple police forces and national cybercrime units classify these actions as potential violations of fraud and computer misuse statutes.

Notable tactics include compromising school email accounts to impersonate legitimate staff members, enabling fraudulent requests for examination materials from targeted boards. While specific malware families or tooling remain unspecified in public reporting, the operation demonstrates capability to breach organizational email systems and exfiltrate sensitive documents during critical examination periods. The June 2023 campaign against British exam boards represents their most significant documented operation, involving coordinated theft and online distribution of stolen papers. This incident triggered disqualification risks for students who purchased materials, with potential lifetime bans from retaking affected qualifications and cascading impacts on university admissions. Police investigations remain ongoing without public attribution to state actors or criminal consortia, though the scale suggests organized activity. The operation prompted exceptional collaboration between examination authorities and cybersecurity units to mitigate widespread cheating implications.

Incidents

Attributed incidents are available to members.