✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Odido 2026 Data Breach: A Case Study in Social Engineering Vulnerabilities
In February 2026, Dutch telecommunications provider Odido experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers employed sophisticated social engineering tactics, including phishing emails and impersonation of IT staff, to gain unauthorized access to Odido's customer relationship management system. This breach resulted in the exposure of sensitive personal information of approximately 6.2 million customers, encompassing names, addresses, phone numbers, email addresses, dates of birth, customer numbers, bank account numbers, and identification details. Notably, passwords, call records, and billing information remained uncompromised. The incident stands as one of the largest private data leaks in Dutch history, highlighting critical vulnerabilities in data security practices within the telecommunications sector. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai)) This breach underscores the escalating threat posed by social engineering attacks targeting customer service systems. The incident serves as a stark reminder for organizations to bolster their cybersecurity measures, particularly in safeguarding customer data against increasingly sophisticated attack vectors. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai))
4 months ago
Kill Chain
Understanding the Google Gemini 2025 Prompt Injection Vulnerability
In mid-2025, security researchers identified a significant vulnerability in Google's AI assistant, Gemini, integrated into Gmail and other Workspace applications. This flaw, known as 'prompt injection,' allowed attackers to embed hidden instructions within emails using HTML and CSS techniques, such as invisible text. When Gemini processed these emails to generate summaries, it executed the concealed commands, potentially leading to deceptive summaries that could mislead users into divulging sensitive information or performing unintended actions. The exploitation of this vulnerability posed substantial risks, including unauthorized access to user data and increased susceptibility to phishing attacks. ([techradar.com](https://www.techradar.com/pro/security/google-gemini-can-be-hijacked-to-display-fake-email-summaries-in-phishing-scams?utm_source=openai)) The discovery of this vulnerability underscores the evolving nature of cyber threats targeting AI-driven platforms. As AI assistants become more integrated into daily workflows, they present new attack vectors that traditional security measures may not fully address. This incident highlights the critical need for continuous monitoring and updating of AI systems to safeguard against emerging threats and to maintain user trust in these technologies.
4 months ago
Kill Chain
Understanding the 2026 RTF Malware Delivery Exploit
In early 2026, cybersecurity researchers identified a sophisticated malware delivery method exploiting Rich Text Format (RTF) files. Attackers embedded malicious ZIP files within RTF documents, which, when opened, executed embedded scripts to download and install malware on the victim's system. This technique bypassed traditional security measures by leveraging the inherent trust in RTF files and the complexity of detecting embedded compressed files. The campaign targeted various sectors, leading to data breaches and operational disruptions. This incident underscores the evolving tactics of cyber adversaries who continuously adapt to circumvent security defenses. The use of RTF files for malware delivery highlights the need for organizations to enhance their email filtering, user awareness training, and endpoint detection capabilities to mitigate such threats.
4 months ago
Kill Chain
Chrome's 2026 WebView Vulnerability: A Cautionary Tale of Malicious Extensions
In January 2026, a high-severity vulnerability (CVE-2026-0628) was discovered in Google Chrome's WebView component, allowing attackers to exploit insufficient policy enforcement. By convincing users to install malicious extensions, attackers could inject scripts or HTML into privileged pages, potentially leading to unauthorized data access and system compromise. Google promptly addressed this issue by releasing Chrome version 143.0.7499.192, mitigating the risk posed by this flaw. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-0628/?utm_source=openai)) This incident underscores the critical importance of vigilant extension management and prompt software updates. The exploitation of browser vulnerabilities through malicious extensions highlights the evolving tactics of cyber adversaries, emphasizing the need for continuous monitoring and robust security practices to protect sensitive information.
4 months ago
Kill Chain
AI-Enhanced Reconnaissance: Adapting to the New Cyber Threat Landscape
In 2026, cyber adversaries have increasingly leveraged AI-enhanced reconnaissance techniques to conduct 'silent probing' campaigns. These operations involve prolonged, subtle monitoring of organizational defenses to map detection thresholds, response times, and operational routines. By analyzing defender behaviors over time, attackers can tailor subsequent attacks to evade detection and maximize impact. This shift from targeting technical vulnerabilities to exploiting behavioral patterns has led to more sophisticated and successful breaches, underscoring the need for adaptive and unpredictable defense strategies. The rise of AI-driven reconnaissance signifies a paradigm shift in cyber threats, emphasizing the importance of behavioral analysis in security postures. Organizations must now contend with adversaries who can learn and adapt to their defensive measures, making traditional, static security protocols insufficient. This evolution necessitates a reevaluation of incident response strategies to incorporate dynamic and behavior-based defense mechanisms.
4 months ago
Kill Chain
Google Cloud API Keys Exposed with Gemini Access - 2026
In February 2026, security researchers discovered that thousands of Google Cloud API keys, previously used as non-sensitive billing identifiers, were publicly exposed and could be exploited to access sensitive Gemini AI endpoints. This exposure occurred when the Gemini API was enabled on existing projects, inadvertently granting these keys authentication capabilities without notifying developers. Attackers could leverage these keys to access private data and incur significant charges on victims' accounts. This incident underscores the evolving risks associated with API key management and the importance of regularly auditing and securing API credentials. Organizations must be vigilant in monitoring their API configurations to prevent unauthorized access and potential financial losses.
5 months ago
Kill Chain
Cisco Catalyst SD-WAN Authentication Bypass Vulnerability Exploited Since 2023
In February 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20127) in its Catalyst SD-WAN Controller and Manager, rated with a CVSS score of 10.0. This flaw allows unauthenticated, remote attackers to gain high-privileged access by exploiting a malfunctioning peering authentication mechanism. The threat actor group UAT-8616 has been actively exploiting this vulnerability since at least 2023, enabling them to manipulate SD-WAN fabric configurations via the NETCONF protocol. The exploitation involves downgrading the SD-WAN system to a vulnerable version, achieving root access, and restoring the original firmware to evade detection. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-rpa-EHchtZk.html?utm_source=openai)) The urgency of this issue is underscored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding CVE-2026-20127 to its Known Exploited Vulnerabilities catalog, mandating immediate remediation by federal agencies. This incident highlights the persistent threat posed by sophisticated actors targeting critical infrastructure components, emphasizing the need for organizations to promptly apply patches, monitor for unauthorized access, and implement robust network segmentation to mitigate potential impacts. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-rpa-EHchtZk.html?utm_source=openai))
5 months ago
Kill Chain
Understanding the RESURGE Malware: A 2025 Cybersecurity Threat
In early 2025, the Cybersecurity and Infrastructure Security Agency (CISA) identified a sophisticated malware variant named RESURGE, which exploited the critical vulnerability CVE-2025-0282 in Ivanti Connect Secure appliances. This vulnerability allowed unauthenticated remote code execution, enabling attackers to deploy RESURGE to establish persistent access, create web shells, harvest credentials, and escalate privileges. The malware's advanced evasion techniques, including network-level stealth and boot-level persistence, posed significant challenges for detection and remediation. The emergence of RESURGE underscores a growing trend of advanced persistent threats targeting critical infrastructure through zero-day vulnerabilities. Organizations must prioritize timely patching, implement robust monitoring systems, and adopt a zero-trust security model to mitigate such sophisticated attacks.
5 months ago
Kill Chain
ScarCruft's 'Ruby Jumper' Campaign: A New Era in Air-Gapped Network Breaches
In December 2025, the North Korean state-sponsored group ScarCruft (APT37) launched the 'Ruby Jumper' campaign, deploying sophisticated malware to infiltrate air-gapped networks. The attack began with malicious LNK files that, when executed, initiated a multi-stage infection chain. This chain utilized Zoho WorkDrive for command-and-control communications and leveraged removable media to bridge air-gapped systems, enabling data exfiltration and command execution. The campaign introduced new malware tools, including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE, each designed to facilitate various stages of the attack, from initial compromise to surveillance and data theft. ([thehackernews.com](https://thehackernews.com/2026/02/scarcruft-uses-zoho-workdrive-and-usb.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in targeting isolated networks, highlighting the need for enhanced security measures to protect sensitive environments. The use of legitimate cloud services for C2 communications and the exploitation of removable media to breach air-gapped systems represent significant advancements in cyber-espionage techniques, posing increased risks to critical infrastructure and sensitive data repositories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/apt37-hackers-use-new-malware-to-breach-air-gapped-networks/?utm_source=openai))
5 months ago
Kill Chain
Sangoma FreePBX 2025 INJ3CTOR3 Web Shell Attacks
In December 2025, over 900 Sangoma FreePBX instances were compromised through the exploitation of CVE-2025-64328, a high-severity command injection vulnerability. This flaw allowed authenticated users to execute arbitrary shell commands, leading to the deployment of the EncystPHP web shell by the threat actor group INJ3CTOR3. The attacks resulted in unauthorized remote access and control over affected VoIP infrastructures, with significant concentrations of compromised systems in the U.S., Brazil, Canada, Germany, and France. ([thehackernews.com](https://thehackernews.com/2026/02/900-sangoma-freepbx-instances.html?utm_source=openai)) The incident underscores the critical importance of timely patch management and restricting administrative access to prevent exploitation of known vulnerabilities. Organizations are urged to update their FreePBX deployments to the latest version and implement stringent access controls to mitigate similar threats. ([securityweek.com](https://www.securityweek.com/900-sangoma-freepbx-instances-infected-with-web-shells/?utm_source=openai))
5 months ago
Kill Chain
Cisco SD-WAN Zero-Day Exploited Since 2023
In February 2026, Cisco disclosed a critical zero-day vulnerability (CVE-2026-20127) in its Catalyst SD-WAN Controller and Manager, which had been actively exploited since at least 2023. The flaw allowed unauthenticated remote attackers to bypass authentication mechanisms, granting them high-privileged access to manipulate network configurations via the NETCONF protocol. This exploitation enabled the addition of rogue peers and potential disruption of network operations. ([thehackernews.com](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html?utm_source=openai)) The incident underscores the persistent targeting of network infrastructure by sophisticated threat actors, emphasizing the need for organizations to prioritize timely patching and robust security measures to protect critical systems. ([thehackernews.com](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html?utm_source=openai))
5 months ago
Kill Chain
Critical Vulnerability in Pelco Sarix Pro 3 Series IP Cameras: Immediate Action Required
In February 2026, a critical authentication bypass vulnerability (CVE-2026-1241) was identified in Pelco, Inc.'s Sarix Pro 3 Series IP Cameras, affecting firmware versions up to 02.52. This flaw allows unauthorized access to the cameras' web management interface, enabling attackers to view live video streams and potentially manipulate device settings without proper authentication. The vulnerability poses significant privacy risks and operational challenges for organizations utilizing these surveillance systems. The incident underscores the growing threat landscape targeting IoT devices, particularly in critical infrastructure sectors such as commercial facilities, defense, energy, healthcare, and transportation. As cyber adversaries increasingly exploit vulnerabilities in connected devices, it is imperative for organizations to prioritize regular firmware updates, implement robust access controls, and conduct comprehensive security assessments to mitigate potential risks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports