Renauld Clayton
Attribution profile
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Renauld Clayton, also known by the alias Renauld Clayton, is a former admissions employee at Tennessee State University who resided in Nashville, United States of America. He was indicted in May 2019 after an investigation revealed that he had orchestrated a student loan fraud and identity theft scheme while employed in the university’s admissions office. Clayton pleaded guilty in February 2020 to wire fraud, aggravated identity theft and related charges, resulting in a federal prison sentence of over 30 months and an order to repay the stolen funds. The scheme involved the unauthorized acquisition of students’ personal identifying information, which he used to fraudulently apply for financial aid in their names. Approximately $84,506 in student loan proceeds were diverted to bank accounts that he controlled under a false name and Social Security number. During the investigation authorities also recovered a counterfeit Social Security card, a stolen driver’s license and numerous credit and debit cards in his possession.
Clayton’s targeting was confined to the education sector, specifically exploiting his insider position at a single institution located in the United States. His strategic objective was purely financial gain, as evidenced by the diversion of loan funds to accounts he controlled for personal use. The tactics, techniques and procedures observed in this case relied on abuse of legitimate access rather than external hacking; he used his employment to obtain personal data, submitted fraudulent loan applications, and employed counterfeit identification documents to facilitate the fraud. No malware families, exploit tools or external initial access vectors were referenced in the reporting; the threat stemmed entirely from his insider status and the misuse of institutional privileges.
No public attribution links Clayton to any state‑sponsored group, criminal consortium or broader affiliate network; he acted as an individual perpetrator. The Tennessee State University student loan fraud represents the sole notable campaign publicly associated with him, culminating in his sentencing and restitution obligation. The case is frequently cited as an illustration of insider threat dynamics within educational environments, where trusted personnel misuse access to personal data for monetary profit.
Incidents
Attributed incidents are available to members.
1 incident