✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Critical n8n RCE Vulnerability (CVE-2025-68613) Leads to System Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw, present in versions from 0.211.0 up to but not including 1.120.4, 1.121.1, and 1.122.0, allows authenticated users to execute arbitrary code with the privileges of the n8n process. Exploitation can lead to full system compromise, including unauthorized data access and workflow manipulation. Despite patches being released, as of early February 2026, over 24,700 unpatched instances remain exposed online, with significant concentrations in North America and Europe. The inclusion of CVE-2025-68613 in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to address this issue. The widespread exposure highlights the critical need for prompt patching and vigilant security practices to mitigate potential exploitation risks.
4 months ago
Kill Chain
AI-Generated Slopoly Malware Facilitates Interlock Ransomware Attack in 2026
In March 2026, a new malware strain named Slopoly, likely created using generative AI tools, was utilized in an Interlock ransomware attack. The breach began with a ClickFix social engineering tactic, leading to the deployment of Slopoly as a PowerShell script acting as a client for the command-and-control framework. This allowed the threat actor to maintain access to the compromised server for over a week, during which data was exfiltrated prior to encryption. The attack was attributed to Hive0163, a financially motivated group focused on extortion through large-scale data exfiltration and ransomware. The use of AI-generated malware like Slopoly indicates a significant evolution in cyber threats, enabling attackers to develop custom malware rapidly and potentially evade traditional detection mechanisms. This incident underscores the urgent need for organizations to enhance their cybersecurity defenses against increasingly sophisticated and AI-assisted attack vectors.
4 months ago
Kill Chain
Phishing Attack Trends 2026: Rising Threats and Evolving Tactics
In 2025, phishing attacks surged by over 20%, with attackers leveraging advanced social engineering techniques and AI-generated content to craft highly convincing lures. This evolution led to a significant increase in successful breaches, resulting in substantial financial losses and compromised sensitive data across various sectors. The proliferation of Phishing-as-a-Service kits enabled even less-skilled cybercriminals to execute large-scale campaigns, further exacerbating the threat landscape. ([trustnetinc.com](https://trustnetinc.com/resources/phishing-threats-2026/?utm_source=openai)) The current relevance of this trend is underscored by the continuous refinement of phishing tactics, including the use of AI to automate and personalize attacks, making them more effective and harder to detect. Organizations must remain vigilant and adapt their security measures to counter these evolving threats effectively. ([cloudsek.com](https://www.cloudsek.com/knowledge-base/top-phishing-attack-trends?utm_source=openai))
4 months ago
Kill Chain
Phishing Campaigns Overwhelm SOC Analysts in 2026
In early 2026, cybersecurity firms observed a surge in sophisticated phishing campaigns designed not only to deceive employees but also to inundate Security Operations Centers (SOCs) with an overwhelming volume of alerts. Attackers utilized automated tools to dispatch thousands of phishing emails, many of which were low-sophistication lures intended to flood SOCs with reports. Amidst this deluge, highly targeted spear-phishing emails were sent to individuals with critical system access, effectively camouflaging these high-risk threats within the noise. This tactic led to significant delays in threat detection and response, increasing the likelihood of successful breaches. This trend underscores a critical shift in cyberattack strategies, where adversaries exploit the operational limitations of SOCs, particularly their capacity to process high volumes of alerts. The effectiveness of these campaigns highlights the urgent need for organizations to enhance their SOC capabilities, incorporating advanced automation and AI-driven tools to manage alert triage efficiently and mitigate the risk of alert fatigue among analysts.
4 months ago
Kill Chain
Hive0163's AI-Generated Slopoly Malware: A New Era of Ransomware Attacks
In early 2026, the financially motivated threat actor Hive0163 executed a ransomware attack utilizing an AI-generated malware named Slopoly. The attack began with a social engineering tactic called ClickFix, tricking victims into executing a PowerShell command that downloaded NodeSnake, a known malware associated with Hive0163. NodeSnake established persistence and facilitated the deployment of Interlock RAT, which in turn delivered Slopoly. Slopoly, developed with the assistance of a large language model, functioned as a backdoor, maintaining persistent access to the compromised server for over a week. It communicated with a command-and-control server, enabling the execution of commands and exfiltration of data. This incident underscores the evolving threat landscape where AI is leveraged to expedite malware development, reducing the time required for threat actors to create and deploy sophisticated attacks. The use of AI in malware creation signifies a shift towards more efficient and scalable cyber threats, necessitating enhanced defensive measures and vigilance.
4 months ago
Kill Chain
Cyberhaven's 2024 Chrome Extension Breach: A Supply Chain Attack Case Study
In December 2024, Cyberhaven, a data-loss prevention company, experienced a significant security breach when attackers compromised their Chrome Web Store account through a phishing attack. This allowed the publication of a malicious update (version 24.10.4) to their Chrome extension, which was automatically distributed to users. The compromised extension exfiltrated sensitive data, including authenticated sessions and cookies, to an attacker-controlled domain. The malicious version was available for approximately 25 hours before detection and removal. ([techcrunch.com](https://techcrunch.com/2024/12/27/cyberhaven-says-it-was-hacked-to-publish-a-malicious-update-to-its-chrome-extension/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting browser extensions. With the increasing reliance on browser-based tools in enterprise environments, such attacks can lead to widespread data breaches and operational disruptions. Organizations must enhance their security protocols to mitigate such risks.
4 months ago
Kill Chain
INC Ransomware Group's 2025 Assault on Oceania's Healthcare Sector
Between July 2024 and December 2025, the INC Ransomware Group orchestrated a series of attacks targeting healthcare organizations across Australia, New Zealand, and Tonga. Utilizing tactics such as spear-phishing, exploitation of unpatched systems, and leveraging credentials from initial access brokers, the group infiltrated networks, exfiltrated sensitive data, and deployed ransomware to encrypt critical systems. Notably, in June 2025, INC disrupted Tonga's Ministry of Health, effectively shutting down core national services. ([darkreading.com](https://www.darkreading.com/threat-intelligence/inc-ransomware-healthcare-oceania?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks on the healthcare sector, emphasizing the need for robust cybersecurity measures, timely patch management, and comprehensive incident response strategies to safeguard patient data and ensure the continuity of essential health services.
4 months ago
Kill Chain
Microsoft Copilot's 2026 Reprompt Exploit: A Wake-Up Call for AI Security
In early 2026, a critical vulnerability known as the "Reprompt" exploit was discovered in Microsoft Copilot by Varonis Threat Labs. This flaw allowed attackers to embed a "q parameter" within phishing links, which, when clicked, silently activated Copilot to exfiltrate sensitive user data to attacker-controlled servers. Remarkably, this attack required no further user interaction beyond the initial click, effectively bypassing existing enterprise security controls. Microsoft promptly addressed and patched the vulnerability by January 13, 2026. ([windowscentral.com](https://www.windowscentral.com/artificial-intelligence/microsoft-copilot/copilot-ai-reprompt-exploit-detailed-2026?utm_source=openai)) The Reprompt exploit underscores the escalating sophistication of AI-targeted cyberattacks, highlighting the necessity for continuous vigilance and robust security measures in AI-integrated applications. As AI systems become more embedded in daily workflows, ensuring their security against such advanced threats is paramount.
4 months ago
Kill Chain
DigitalMint Insider Ransomware Scheme Unveiled
In 2023, Angelo John Martino III, a ransomware negotiator at DigitalMint, exploited his position to orchestrate at least 10 ransomware attacks, extorting over $75 million. Martino, along with co-conspirators, infiltrated networks, encrypted data, and demanded ransoms, even negotiating with victims he had attacked. This breach highlights the severe risks posed by insider threats in cybersecurity firms. The incident underscores the critical need for robust internal controls and vigilant monitoring to prevent such breaches, especially as ransomware tactics evolve and insider threats become more sophisticated.
4 months ago
Kill Chain
PhantomRaven NPM Attack 2026: A Wake-Up Call for Open-Source Security
Between November 2025 and February 2026, the 'PhantomRaven' supply-chain attack targeted the npm registry, introducing 88 malicious packages through 50 disposable accounts. These packages, often mimicking legitimate projects like Babel and GraphQL Codegen, utilized a technique called Remote Dynamic Dependencies (RDD) to fetch and execute malicious code from external URLs during installation. The malware harvested sensitive information from developers' systems, including emails, CI/CD tokens, and system details, subsequently exfiltrating this data to the attackers' command-and-control servers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages/?utm_source=openai)) This incident underscores the escalating threat of supply-chain attacks in open-source ecosystems, highlighting the need for developers to exercise caution when integrating third-party packages. The use of AI-generated package names and sophisticated evasion techniques like RDD exemplify the evolving tactics of threat actors, emphasizing the importance of vigilant package management and verification practices.
4 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading medical technology company, experienced a significant cyberattack attributed to the pro-Iranian hacktivist group Handala. The attackers claimed to have infiltrated Stryker's global network, exfiltrated 50 terabytes of sensitive data, and deployed wiper malware that erased data on over 200,000 systems, servers, and mobile devices. This attack led to widespread operational disruptions across Stryker's offices in 79 countries, severely impacting their ability to deliver medical products and services. ([investing.com](https://www.investing.com/news/stock-market-news/stryker-stock-falls-34-on-iranlinked-cyberattack-report-93CH-4554963?utm_source=openai)) This incident underscores the escalating threat posed by politically motivated cyberattacks targeting critical infrastructure sectors. Organizations in the healthcare and medical technology industries must enhance their cybersecurity measures to protect against such sophisticated and destructive attacks.
4 months ago
Kill Chain
Critical n8n RCE Vulnerability (CVE-2025-68613) Exposes Systems to Full Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users to execute arbitrary code on the server by exploiting insufficient isolation in the workflow expression evaluation system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive data and modification of workflows. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-68613?utm_source=openai)) The vulnerability was addressed in n8n versions 1.120.4, 1.121.1, and 1.122.0. However, as of March 2026, over 40,000 unpatched instances remain exposed online, with significant concentrations in North America and Europe. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports