There is a great deal of interest in cybersecurity these days. I've seen advertisements that say one can become a cyber expert in 6 months. Hmmmmm ...
Entities that offer such training should provide their students sandbox servers for them to learn. However, that won't stop them from choosing targets of their own ..... and what could be better than the Moodle server where they have courses? There could be some motivation there (grades?).
End users themselves are becoming more aware and attempting to do something about it ... like using CloudFlare as a VPN for iPhones and Android devices.
"To use Cloudflare as a VPN on an iPhone, you can download the "1.1.1.1 with WARP" app, which essentially functions as a free VPN service provided by Cloudflare; simply install the app and toggle the WARP button to connect and encrypt your internet traffic across your device."
The server is only one end ... devices/workstations, etc. is the other end. Wonder if your customer has seen issues with their own students/faculty/staff?
'SoS', Ken