The Containment Era is here. →Explore

Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

2549 threat reports
Page 1 of 213

Explore Other Sectors

Accounting
Aerospace
Aerospace/Aviation
Agriculture
Airlines/Aviation
Animation
Apparel/Fashion
Architecture/Planning
Artificial Intelligence
Artificial Intelligence/Machine Learning
Arts/Crafts
Automotive
Aviation/Aerospace
Banking/Mortgage
Biotechnology/Greentech
Blockchain/Cryptocurrency
Broadcast Media
Broadcasting Media
Broadcasting/Media
Building Materials
Business Supplies/Equipment
Capital Markets/Hedge Fund/Private Equity
Chemical
Chemicals
Civic/Social Organization
Civil Engineering
Cloud Computing
Cloud Computing/SaaS
Cloud Services
Commercial Facilities
Commercial Real Estate
Computer Games
Computer Hardware
Computer Networking
Computer Software/Engineering
Computer/Network Security
Construction
Consulting
Consumer Electronics
Consumer Goods
Consumer Services
Cosmetics
Cosmetics
Critical Manufacturing
Cryptocurrencies
Customer Services
Cybersecurity
Dairy
Dating/Personal Services
Defense/Space
Design
E-Learning
Education Management
Electrical/Electronic Manufacturing
Emergency Services
Energy
Energy/Oil/Solar/Greentech
Entertainment/Movie Production
Environmental Services
Events Services
Facilities Services
Farming
Fashion/Apparel
Financial Services
Fine Art
Fishery
Food Production
Food/Beverages
Fortune 500 companies
Franchising
Fundraising
Gambling/Casinos
Gaming
Gaming/Casinos
Government Administration
Government Facilities
Government Relations
Graphic Design/Web Design
Health Care / Life Sciences
Higher Education/Acadamia
Hospitality
Human Resources/HR
Import/Export
Individual/Family Services
Industrial Automation
Information Services
Information Technology/IT
Insurance
International Affairs
International Trade/Development
Internet
Investment Banking/Venture
Investment Management/Hedge Fund/Private Equity
Judiciary
Law Enforcement
Law Practice/Law Firms
Legal Services
Legislative Office
Leisure/Travel
Logistics/Procurement
Luxury Goods/Jewelry
Machinery
Management Consulting
Manufacturing
Maritime
Marketing/Advertising/Sales
Mechanical or Industrial Engineering
Media Production
Medical Equipment
Medical Practice
Military Industry
Mining/Metals
Mobile
Museums/Institutions
Music
Newspapers/Journalism
Non-Profit/Volunteering
Oil/Energy/Solar/Greentech
Online Publishing
Outsourcing/Offshoring
Package/Freight Delivery
Parking
Pharmaceuticals
Philanthropy
Photography
Plastics
Political Organization
Primary/Secondary Education
Professional Training
Public Relations/PR
Public Safety
Publishing Industry
Railroad Manufacture
Real Estate/Mortgage
Recreational Facilities/Services
Religious Institutions
Renewables/Environment
Research Industry
Restaurants
Retail Industry
Robotics
Rural Healthcare
Security/Investigations
Semiconductors
Sporting Goods
Sports
Staffing/Recruiting
Supermarkets
Technology
Technology/IT
Telecommunications
Think Tanks
Toys and Games
Transportation
Travel/Tourism
Trucking/Freight
Utilities
Venture Capital/VC
Warehousing
Water and Waste Management
Water and Wastewater
Water and Wastewater Systems
Water and Wastewater Treatment
Water, Waste, Steam, and Air Conditioning Services
Water/Wastewater Management
Water/Wastewater/Utilities
Wholesale
Wireless

Health Care / Life Sciences Threat Reports

Showing 112 / 2549 reports
DevMan RaaS Platform: A New Era in Organized Cybercrime
Impact· HIGH

DevMan RaaS Platform: A New Era in Organized Cybercrime

In April 2025, the DevMan ransomware-as-a-service (RaaS) operation emerged, initially affiliating with groups like Qilin, DragonForce, Apos, and RansomHub. By July 2025, DevMan transitioned into an independent RaaS platform, offering affiliates a centralized web portal for payload generation, financial management, victim communication, and operational coordination. This portal streamlined the ransomware deployment process, integrating access brokerage with ransomware execution, and imposed strict completion timelines on affiliates. The operation has claimed 184 victims to date, with nearly 50 located in the U.S., targeting sectors such as technology, healthcare, financial services, professional services, and government. The evolution of DevMan underscores a significant shift in the ransomware landscape, where threat actors are developing sophisticated, centralized platforms to enhance operational efficiency and scalability. This trend highlights the increasing professionalization of cybercriminal enterprises and the need for organizations to bolster their cybersecurity defenses against such organized threats.

7 hours ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(high)
Read Report
Fastjson 1.x RCE Vulnerability (CVE-2026-16723) Poses Critical Threat to Java Applications
Impact· CRITICAL

Fastjson 1.x RCE Vulnerability (CVE-2026-16723) Poses Critical Threat to Java Applications

In July 2026, a critical remote code execution (RCE) vulnerability, CVE-2026-16723, was identified in Fastjson versions 1.2.68 through 1.2.83. This flaw allows attackers to execute arbitrary code on affected systems by sending malicious JSON payloads, even with default configurations. The vulnerability is particularly concerning for Spring Boot applications deployed as executable fat JARs, as it can be exploited without enabling AutoType or requiring additional classpath gadgets. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/?utm_source=openai)) The exploitation of this vulnerability has been observed in the wild, with attacks primarily targeting organizations in the United States, Singapore, and Canada. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/?utm_source=openai)) Given the widespread use of Fastjson in Java applications, this vulnerability poses a significant risk to numerous systems, emphasizing the need for immediate mitigation measures.

7 hours ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(medium)
Read Report
Critical Security Update: GitLab AI Gateway RCE Vulnerability (CVE-2026-1868)
Impact· HIGH

Critical Security Update: GitLab AI Gateway RCE Vulnerability (CVE-2026-1868)

In February 2026, GitLab addressed a critical vulnerability (CVE-2026-1868) in its AI Gateway's Duo Workflow Service component. This flaw allowed authenticated users to execute arbitrary code by exploiting insecure template expansion within crafted Duo Agent Platform Flow definitions. The vulnerability posed significant risks, including potential denial-of-service attacks and unauthorized code execution on the Gateway. Organizations utilizing self-hosted GitLab AI Gateway instances were urged to apply the security patches promptly to mitigate these threats. The incident underscores the evolving landscape of cybersecurity threats targeting AI infrastructure components. As AI systems become integral to business operations, ensuring their security is paramount. This case highlights the necessity for continuous monitoring and timely patching of AI-related services to prevent exploitation by malicious actors.

7 hours ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(low)
C&C
Command & Control(low)
E
Exfiltration(low)
I
Impact(low)
Read Report
The Rise of Residential Proxy Botnets: A New Cybersecurity Challenge
Impact· HIGH

The Rise of Residential Proxy Botnets: A New Cybersecurity Challenge

In July 2026, Lumen Technologies' Black Lotus Labs reported a significant surge in botnets utilizing residential proxy networks, with nearly 60 million compromised IP addresses globally. Approximately 25% of these infected IPs are located in the United States. Notably, the IPIDEA botnet, after a coordinated takedown in January, rebounded to half its size within hours and has since expanded to about 10 million IPs. This rapid recovery underscores the resilience and adaptability of such botnets. ([cyberscoop.com](https://cyberscoop.com/botnets-residential-proxy-networks-proliferate-lumen-black-lotus-labs/?utm_source=openai)) The proliferation of these botnets is driven by a growing market demand for residential IPs, enabling cybercriminals to mask malicious activities within legitimate traffic. The increasing availability of vulnerable devices, coupled with the cessation of security updates for older products, exacerbates the issue. ([cyberscoop.com](https://cyberscoop.com/botnets-residential-proxy-networks-proliferate-lumen-black-lotus-labs/?utm_source=openai))

8 hours ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(high)
LM
Lateral Movement(high)
C&C
Command & Control(high)
E
Exfiltration(high)
I
Impact(high)
Read Report
HalluSquatting: A New Frontier in AI-Driven Cyberattacks
Impact· HIGH

HalluSquatting: A New Frontier in AI-Driven Cyberattacks

In July 2026, researchers from Tel Aviv University, Technion, and Intuit identified a novel cyberattack method termed 'HalluSquatting.' This technique exploits AI coding agents' tendency to generate plausible but non-existent package or repository names—a phenomenon known as hallucination. Attackers preemptively register these hallucinated names with malicious content, leading AI agents to inadvertently fetch and execute harmful code. This method enables attackers to scale their operations without traditional vectors like phishing or credential theft, potentially transforming AI agents into unwitting participants in botnet propagation. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/hallusquatting-is-the-latest-agentic-ai-exploit-where-models-dream-up-potentially-malicious-urls-in-tool-calls-attack-exploits-a-fundamental-weakness-in-every-available-model?utm_source=openai)) The emergence of HalluSquatting underscores a critical vulnerability in AI-driven development environments. As AI coding assistants become more integrated into software development workflows, the risk of such attacks amplifies. This incident highlights the urgent need for enhanced validation mechanisms and security protocols to prevent AI agents from executing unverified code, thereby safeguarding against the exploitation of AI hallucinations by malicious actors. ([ai2.work](https://ai2.work/blog/hallusquatting-the-ai-hallucination-attack-hijacking-coding-agents?utm_source=openai))

23 hours ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(medium)
Read Report
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Impact· HIGH

Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts

In July 2026, cybersecurity firm ReliaQuest identified a campaign where attackers compromised Wi-Fi devices in hotels and conference centers to hijack DNS settings. This manipulation redirected users attempting to access legitimate Microsoft 365 login pages to attacker-controlled phishing sites, leading to credential theft. The campaign, active since at least June 2026, affected various sectors, including financial services, healthcare, and retail, across multiple countries such as the U.S., India, and Saudi Arabia. The attackers exploited weakly protected management interfaces or unpatched vulnerabilities in Wi-Fi gateways to gain administrative access and alter DNS configurations. This method allowed them to intercept sensitive business information and communications without direct access to the victims' devices. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai)) This incident underscores the evolving tactics of threat actors, who are increasingly targeting network infrastructure to bypass traditional endpoint security measures. The use of DNS hijacking to facilitate adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including those in transient environments like hotels and conference centers. Implementing robust security practices, such as using always-on, full-tunnel VPNs and encrypted DNS, is crucial to mitigate such threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/?utm_source=openai))

23 hours ago

Kill Chain

IC
Initial Compromise(medium)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(medium)
Read Report
Interlock Ransomware's 2026 Exploitation of Cisco FMC Zero-Day Vulnerability
Impact· CRITICAL

Interlock Ransomware's 2026 Exploitation of Cisco FMC Zero-Day Vulnerability

In early 2026, the Interlock ransomware group exploited a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) software, allowing unauthenticated remote code execution as root. This exploitation began on January 26, 2026, 36 days prior to Cisco's public disclosure on March 4, 2026. The attackers leveraged this vulnerability to gain initial access, deploying custom malware and remote access tools to establish persistence, conduct reconnaissance, and ultimately deploy ransomware across various sectors, including education, healthcare, and manufacturing. The campaign demonstrated a high level of sophistication, utilizing fileless implants and memory-resident webshells to evade detection. ([aws.amazon.com](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/?utm_source=openai)) This incident underscores the increasing trend of ransomware groups exploiting zero-day vulnerabilities to infiltrate enterprise networks. The rapid exploitation of CVE-2026-20131 highlights the critical need for organizations to implement proactive vulnerability management, continuous monitoring, and robust incident response strategies to mitigate the risks associated with such advanced persistent threats.

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(high)
LM
Lateral Movement(high)
C&C
Command & Control(high)
E
Exfiltration(high)
I
Impact(high)
Read Report
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage
Impact· HIGH

HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage

In July 2026, cybersecurity researchers uncovered HollowGraph, a sophisticated malware that exploits Microsoft 365 calendar events for covert command-and-control (C2) communication and data exfiltration. By embedding encrypted instructions and stolen data within calendar events dated far into the future (e.g., May 13, 2050), HollowGraph effectively evades detection by blending malicious activities with legitimate Microsoft Graph API traffic. This technique has been observed targeting at least 12 Israeli organizations, with active communications detected between June and July 2026. The malware's design allows it to bypass traditional security measures, posing significant risks to organizations relying on Microsoft 365 services. The emergence of HollowGraph underscores a growing trend where threat actors leverage trusted cloud services to conduct stealthy cyber-espionage campaigns. This incident highlights the critical need for organizations to enhance monitoring of cloud-based activities, implement robust identity and access management controls, and stay vigilant against novel attack vectors that exploit legitimate platforms for malicious purposes.

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(high)
E
Exfiltration(high)
I
Impact(medium)
Read Report
Critical Azure Automation Vulnerability (CVE-2025-29827) Exposes Cross-Tenant Identity Risks
Impact· HIGH

Critical Azure Automation Vulnerability (CVE-2025-29827) Exposes Cross-Tenant Identity Risks

In May 2025, a critical vulnerability (CVE-2025-29827) was identified in Microsoft's Azure Automation service, which is widely used for DevOps, resource deployment, and configuration management. The flaw stemmed from improper authorization mechanisms, allowing authenticated attackers to escalate privileges over the network. Exploiting this vulnerability, attackers could assume another tenant's automation identity, enabling them to create or modify automation scripts and access sensitive configuration data or credentials stored in Azure Automation accounts. This could lead to unauthorized creation, modification, or deletion of resources across an organization's cloud workloads. The vulnerability was assigned a CVSS score of 9.9, indicating its critical severity. Microsoft addressed the issue by updating the default settings to prevent automation accounts from being publicly accessible and issued an advisory to inform users of the necessary security measures. Organizations are advised to audit their Azure Automation configurations and ensure that proper access controls are in place to mitigate potential attacks.

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(high)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(medium)
Read Report
Critical Vulnerabilities Discovered in Johnson Controls' C-CURE 9000 and Victor Application Servers
Impact· HIGH

Critical Vulnerabilities Discovered in Johnson Controls' C-CURE 9000 and Victor Application Servers

In July 2026, multiple critical vulnerabilities were identified in Johnson Controls' C-CURE 9000 and Victor application servers, widely used in physical security management. These vulnerabilities, including CVE-2026-21655, CVE-2026-21653, and CVE-2026-34496, could allow unauthenticated attackers to execute arbitrary code, perform server-side request forgery, and escalate privileges, potentially compromising physical security systems and sensitive data. ([johnsoncontrols.com](https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories?utm_source=openai)) The discovery of these vulnerabilities underscores the increasing targeting of critical infrastructure by cyber threats. Organizations must prioritize patching and implementing robust security measures to protect against such exploits, as the exploitation of these flaws could lead to significant operational disruptions and security breaches.

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(high)
LM
Lateral Movement(high)
C&C
Command & Control(high)
E
Exfiltration(high)
I
Impact(high)
Read Report
AI Agents Uncover Critical Redis Vulnerabilities: Immediate Action Required
Impact· HIGH

AI Agents Uncover Critical Redis Vulnerabilities: Immediate Action Required

In July 2026, researchers utilizing Moonshot AI's Kimi K3 agents identified multiple zero-day vulnerabilities in Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities allowed authenticated remote code execution (RCE) through the RESTORE command, with additional dependencies on EVAL, XGROUP, and the RedisBloom module in certain versions. Redis promptly released seven security updates on July 23, 2026, to address these critical flaws. Organizations using affected Redis versions are urged to upgrade immediately to mitigate potential exploitation risks. ([eweek.com](https://www.eweek.com/news/moonshot-ai-kimi-k3-redis-rce-exploits-apac-china/?utm_source=openai)) This incident underscores the accelerating role of AI in both discovering and potentially exploiting software vulnerabilities. The rapid identification and proof-of-concept development by AI agents highlight the need for organizations to enhance their security posture and response times to emerging threats. ([news.shield53.com](https://news.shield53.com/ai-agents-discover-redis-zero-days-cve-analysis-and-rce-threat-across-redis-6x8x/?utm_source=openai))

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(medium)
E
Exfiltration(medium)
I
Impact(medium)
Read Report
Golden Chickens Introduces Four New Modular Malware Families in 2026
Impact· LOW

Golden Chickens Introduces Four New Modular Malware Families in 2026

In July 2026, the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem, also known as Venom Spider, introduced four new malware families: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and ChromEggscalator. These developments signify a strategic shift towards modular, operator-driven tools within the TAG-195 MaaS ecosystem. The modularized ChonkyChicken variant employs a controller-and-plugin architecture, allowing the base implant to dynamically load specific capability modules from attacker-controlled infrastructure, thereby reducing its static detection footprint. All four malware families exhibit consistent command-and-control mechanisms, shared persistence methods, string obfuscation, and execution via legitimate Windows binaries. This evolution underscores TAG-195's commitment to enhancing the adaptability and stealth of its offerings, catering to a diverse range of operational requirements. The emergence of these advanced, modular malware families highlights the ongoing sophistication of MaaS providers and the necessity for organizations to bolster their detection and response strategies against such evolving threats.

1 day ago

Kill Chain

IC
Initial Compromise(high)
PE
Privilege Escalation(medium)
LM
Lateral Movement(medium)
C&C
Command & Control(high)
E
Exfiltration(high)
I
Impact(medium)
Read Report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports