NCCapital

The Instructure breach is not only a story about stolen education data. It is also a story about the infrastructure that lets extortion groups stay online long enough to pressure victims.

ShinyHunters, the group claiming responsibility for the Instructure incident, posted a leak notice threatening the release of data tied to schools and universities using Canvas. The group’s message pointed to public leak infrastructure that appears to sit inside a network associated with Prospero OOO, a Russian autonomous system previously discussed by cyber threat researchers for alleged links to bulletproof hosting activity.

That routing clue does not prove that every upstream network in the path knowingly supported the operation. It also does not prove that Kaspersky operated the leak server or participated in the Instructure breach. But it does raise a more important question: why does cybercrime infrastructure remain so durable even when researchers, blocklists, and abuse reports have tracked some of the same networks for years?

The Bigger Story Is Infrastructure

Most breach coverage focuses on the victim, the stolen data, and the attacker name. That makes sense, but it misses the layer that makes extortion work.

A group like ShinyHunters does not only need access to data. It needs places to host threats, publish samples, communicate with victims, stage leaks, and stay reachable after takedown attempts. That requires infrastructure.

Sometimes that infrastructure is hidden behind Tor. Sometimes it uses public IP space. Sometimes it moves through hosting providers with weak abuse controls. Sometimes it sits behind routing relationships that make direct responsibility difficult to untangle.

The Instructure case is useful because it shows the breach as more than an isolated victim incident. It shows the ecosystem around the breach.

Key idea: Cybercrime is not only a malware problem or a hacker problem. It is also an infrastructure problem.

What Happened With Instructure?

Instructure, the company behind the Canvas learning management system, disclosed a cybersecurity incident affecting its cloud-hosted environment. ShinyHunters claimed responsibility and alleged a very large theft of data tied to schools, universities, teachers, students, and staff.

Public reporting says the exposed information may include names, email addresses, student identification numbers, user messages, and course-related information. Instructure has said it found no evidence that passwords, dates of birth, government identifiers, or financial information were involved.

The distinction matters. This does not appear to be a payment-card breach or a password dump based on the currently public information. But education data does not need to include passwords to be valuable. Names, school emails, student IDs, course context, and internal messages can support phishing, impersonation, social engineering, and follow-on attacks.

The claimed affected list is enormous and includes major universities, K-12 districts, public education systems, and training platforms across multiple countries. That list should be treated as attacker-claimed unless each institution confirms its own exposure. Still, the scale of the Canvas ecosystem is exactly why the incident matters.

Why Canvas Is Such a High-Value Target

Canvas is not just a website students use to submit homework. It is part of the operating layer of modern education.

A learning management system can touch course rosters, internal messages, assignments, grades, staff accounts, student identities, integrations, third-party tools, and institutional workflows. It connects students, teachers, administrators, vendors, and external services.

That makes a platform breach different from a single-campus breach. One school’s compromised system is serious. A widely used vendor’s compromised environment can create exposure across thousands of institutions at once.

This is the central risk of cloud concentration in education. Schools get scalability and convenience, but they also inherit vendor-level exposure.

The Prospero OOO Trail

The leak notice connected to the Instructure extortion claim appears to point toward infrastructure associated with Prospero OOO. Public IP intelligence and routing tools identify the relevant network range as associated with AS200593 PROSPERO OOO. The specific address does not need to be republished here. The important issue is the network association and the abuse-history context.

Prospero has already appeared in threat intelligence reporting. Intrinsec described Prospero OOO as a Russian autonomous system it assessed as linked with high confidence to Proton66 and bulletproof services advertised under names such as SecureHost and BEARHOST. Intrinsec also reported malicious activity across related infrastructure, including malware delivery, phishing pages, SMS spam, and other abuse.

That does not automatically prove Prospero itself directly operated the ShinyHunters leak infrastructure. But it does make the connection worth examining. When a network already discussed in bulletproof hosting research appears near extortion infrastructure, defenders should pay attention.

Where Kaspersky Fits Into This

The Kaspersky angle needs careful handling.

KrebsOnSecurity reported in 2025 that Prospero had begun routing its operations through networks run by Kaspersky Lab. That reporting cited routing observations and security researchers who had been tracking Prospero’s infrastructure.

Kaspersky denied directly working with Prospero. The company argued that seeing Kaspersky-operated networks in an AS path does not necessarily mean Kaspersky is providing services to Prospero. Routing paths can reflect telecom providers, transit relationships, DDoS protection arrangements, or other technical intermediaries.

That distinction is important. Routing evidence is not the same thing as operational control.

The careful conclusion is this: the ShinyHunters leak infrastructure appears connected to Prospero-associated routing space, and Prospero has previously been reported as routing through Kaspersky-operated networks. That raises questions about abuse controls and infrastructure accountability, but it does not prove Kaspersky operated the leak server or participated in the breach.

Does This Mean Kaspersky Is Not Legit?

Not from this evidence alone.

Kaspersky already carries trust concerns in some countries because of its Russian jurisdiction and government restrictions against its software. The United States barred federal agencies from using Kaspersky products in 2017, and later restrictions limited the company’s ability to sell software in the U.S. market. Those concerns are real, but they are separate from proving involvement in a specific breach.

The Prospero routing issue is a narrower technical question. It is about whether abuse-linked infrastructure can gain reachability through reputable or semi-reputable upstream networks, and whether those upstreams respond quickly enough when abuse is identified.

The strongest version of the story is not “Kaspersky is behind ShinyHunters.” That would overstate the evidence.

The stronger version is: a network connected to the ShinyHunters leak trail has been tied to bulletproof-hosting research and previously reported routing relationships involving Kaspersky-operated infrastructure. That shows how hard accountability becomes once cybercrime moves into the internet’s routing layer.

Why Bulletproof Hosting Keeps Coming Back

Bulletproof hosting exists because cybercriminals need infrastructure providers that are slow to act, unwilling to act, or built specifically to resist takedowns.

The model is simple. A criminal group needs somewhere to host phishing pages, malware panels, stolen-data pages, command infrastructure, or extortion notices. A normal provider may remove that content after abuse reports. A bulletproof provider looks the other way, delays action, moves customers around, or uses upstream complexity to survive longer.

For extortion groups, uptime is leverage. If a leak site stays online, victims feel pressure. If stolen data can be staged and threatened publicly, the attacker gains negotiating power.

That is why infrastructure is not a side issue. It is part of the attack.

No Confirmed Instructure CVE Yet

There is also no publicly confirmed CVE tied to the Instructure breach at this point.

That matters because the phrase “zero-day” is easy to throw around after a breach. A zero-day means attackers exploited a previously unknown or unpatched vulnerability. That may turn out to be true, but public reporting has not confirmed a specific CVE for this incident.

Based on public information, the root cause could involve several possibilities: a software flaw, stolen credentials, abused access tokens, a third-party integration, exposed API access, or a cloud access weakness.

The safer wording is: ShinyHunters claims Instructure was breached, but no public CVE has been confirmed for the incident.

Why Schools Should Care About the Infrastructure Layer

For schools and universities, the practical concern is not whether they can personally investigate every routing path. Most cannot.

The lesson is that vendor risk does not end with the vendor’s product. It extends into the vendor’s infrastructure, incident response process, integrations, authentication model, and the broader ecosystem around attackers who may exploit the breach.

Institutions should focus on what they can control:

• Ask Instructure for institution-specific exposure details rather than relying only on attacker claims.
• Warn students and staff about phishing using Canvas, grades, course messages, financial aid, or password resets as bait.
• Review Canvas integrations, including LTI tools, API tokens, third-party apps, and privileged accounts.
• Require MFA for administrators, staff, and accounts with elevated access.
• Monitor school domains for targeted phishing that references Canvas or Instructure.
• Demand clearer vendor breach timelines, technical summaries, and remediation details.

The exposed information may not include passwords, but it can still make phishing more convincing. That is the immediate risk.

Why Defenders Should Track Networks, Not Just Domains

Threat infrastructure often changes domains faster than defenders can respond. But routing patterns, hosting providers, autonomous systems, and upstream relationships can reveal longer-term patterns.

That is why ASN-level intelligence matters. If the same networks repeatedly appear around phishing, malware, spam, extortion, or stolen-data operations, defenders can use that history to improve risk scoring and monitoring.

This does not mean every customer on a bad network is malicious. It means infrastructure reputation matters. Just as email security systems score senders by reputation, network infrastructure can be evaluated by recurring abuse patterns.

The hard part is avoiding overclaiming. A routing path can raise suspicion. It does not automatically prove ownership, intent, or direct collaboration.

The Bigger Lesson

The Instructure incident highlights two forms of concentration risk.

The first is education concentration. Thousands of institutions rely on the same learning platform, which means one vendor incident can echo across a huge number of schools.

The second is infrastructure concentration in the abuse economy. Threat actors keep returning to networks and hosting arrangements that let them remain reachable. Even when the brands and domains change, the underlying infrastructure patterns can persist.

That is why this story matters beyond Instructure, ShinyHunters, Prospero, or Kaspersky. It shows that breach response needs to look beyond the compromised application and into the pipes that support cybercrime operations.

The Bottom Line

The Instructure breach is a major EdTech security incident, but the infrastructure trail makes it more than that.

ShinyHunters’ leak infrastructure appears connected to Prospero-associated network space. Prospero has been discussed in threat intelligence reporting for alleged bulletproof hosting links. KrebsOnSecurity previously reported that Prospero had routed through Kaspersky-operated networks, while Kaspersky denied direct involvement and said routing visibility does not prove service provision.

The careful conclusion is not that Kaspersky ran ShinyHunters infrastructure. The careful conclusion is that cybercrime survives through layers of hosting, routing, transit, and abuse-tolerant networks that make accountability difficult.

That is the real story.

Modern breaches are not only about who broke in. They are about the infrastructure that lets attackers publish, pressure, disappear, and return.

Sources

• KrebsOnSecurity: Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab
• Intrinsec: PROSPERO & Proton66: Uncovering the Links Between Bulletproof Networks
• BGP.tools: Prospero OOO prefix routing information
• SecurityWeek: EdTech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats