✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
The Rise of RMM Tool Exploitation in Cyber Attacks
In early 2025, cybersecurity researchers observed a significant increase in cyberattacks leveraging legitimate Remote Monitoring and Management (RMM) tools such as AnyDesk, ScreenConnect, and SimpleHelp. Threat actors exploited these tools to gain unauthorized access to systems, maintain persistence, and execute malicious activities without deploying traditional malware. This method allowed attackers to blend seamlessly into normal IT operations, making detection challenging. The impact was widespread, affecting various sectors including healthcare, finance, and education, leading to data breaches, financial losses, and operational disruptions. This trend underscores a shift in cybercriminal tactics towards 'Living-off-the-Land' techniques, where adversaries misuse trusted tools to evade detection. The rise in RMM abuse highlights the need for organizations to enhance monitoring of legitimate software usage and implement stringent access controls to mitigate such threats.
5 months ago
Kill Chain
Critical Unauthenticated API Vulnerability in Honeywell CCTV Products (CVE-2026-1670)
In February 2026, a critical vulnerability (CVE-2026-1670) was identified in Honeywell CCTV products, allowing unauthenticated attackers to remotely modify the 'forgot password' recovery email address via an exposed API endpoint. This flaw could lead to unauthorized access to camera feeds and potential network compromise. Affected models include I-HIB2PI-UL 2MP IP (version 6.1.22.1216), SMB NDAA MVO-3 WDR_2MP_32M_PTZ_v2.0, PTZ WDR 2MP 32M WDR_2MP_32M_PTZ_v2.0, and 25M IPC WDR_2MP_32M_PTZ_v2.0. ([cvedetails.com](https://www.cvedetails.com/cve/CVE-2026-1670/?utm_source=openai)) The vulnerability underscores the importance of securing IoT devices, especially in critical infrastructure sectors. Organizations are urged to apply patches promptly and implement robust access controls to mitigate such risks.
5 months ago
Kill Chain
Microsoft Office Equation Editor Exploit: A 2026 Malware Campaign
In February 2026, a sophisticated malware campaign exploited the Microsoft Office Equation Editor vulnerability (CVE-2017-11882) to deliver malicious payloads. Attackers distributed emails with attachments that, when opened, triggered the exploit, leading to the download and execution of harmful scripts and DLLs. Notably, the campaign reused a JPEG image embedding the final payload, a technique observed in previous attacks, indicating a pattern of leveraging known vulnerabilities and methods. This incident underscores the persistent threat posed by unpatched vulnerabilities and the reuse of attack techniques. Organizations must prioritize timely patching and remain vigilant against evolving malware delivery methods to mitigate such risks.
5 months ago
Kill Chain
Critical Unauthenticated RCE Vulnerabilities in Ivanti EPMM Exploited
In January 2026, two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, were discovered in Ivanti Endpoint Manager Mobile (EPMM). These vulnerabilities allow unauthenticated remote code execution, enabling attackers to gain full control over mobile device management infrastructure without requiring user interaction or credentials. Exploitation activities have included establishing reverse shells, installing web shells, conducting reconnaissance, and downloading malware. Affected sectors span state and local government, healthcare, manufacturing, professional and legal services, and high technology across the United States, Germany, Australia, and Canada. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) Catalog, underscoring the severity of the threat. Threat actors are rapidly advancing their operations, moving from initial reconnaissance to deploying persistent backdoors designed to maintain long-term access, even after organizations apply patches.
5 months ago
Kill Chain
AI Discovers Critical OpenSSL Vulnerabilities in 2026
In January 2026, the AI-assisted cybersecurity firm Aisle identified twelve previously undisclosed vulnerabilities in OpenSSL, a widely used cryptographic library essential for secure internet communications. These vulnerabilities, some dating back to 1998, included critical issues like CVE-2025-15467, a stack buffer overflow in CMS message parsing that could lead to remote code execution. OpenSSL rated this vulnerability as HIGH severity, with a CVSS v3 score of 9.8 out of 10. The discovery underscores the potential of AI in enhancing cybersecurity measures by identifying complex vulnerabilities that have eluded traditional detection methods. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/ai-assisted-cybersecurity-team-discovers-12-openssl-vulnerabilities-claims-humans-are-the-limiting-factor-some-vulnerabilities-have-been-around-for-decades?utm_source=openai)) The findings highlight the evolving landscape of cybersecurity, where AI tools are becoming instrumental in proactively identifying and mitigating risks. This shift emphasizes the need for organizations to integrate AI-driven solutions into their security protocols to stay ahead of sophisticated cyber threats.
5 months ago
Kill Chain
Chinese APT UNC6201 Exploits Dell RecoverPoint Zero-Day Vulnerability
In mid-2024, the Chinese state-sponsored threat group UNC6201 exploited a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines. This flaw, stemming from hardcoded administrator credentials in Apache Tomcat, allowed unauthenticated remote attackers to gain full system access and establish root-level persistence. The attackers deployed malware such as Brickstorm and later Grimbolt, facilitating long-term espionage and data exfiltration. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure. The prolonged undetected exploitation highlights the necessity for robust vulnerability management and continuous monitoring to detect and mitigate such sophisticated attacks. ([cyberscoop.com](https://cyberscoop.com/china-brickstorm-grimbolt-dell-zero-day/?utm_source=openai))
5 months ago
Kill Chain
Polish Authorities Arrest Phobos Ransomware Affiliate in 2026
In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of Operation Aether, a Europol-coordinated effort targeting Phobos affiliates. During the raid, officials seized computers and mobile phones containing stolen credentials, credit card numbers, and server IP addresses. The suspect allegedly used encrypted messaging to communicate with Phobos members and faces charges under Poland's Criminal Code for creating and distributing software designed to illegally access computer systems. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/17/phobos-ransomware-affiliate-arrested-in-poland/?utm_source=openai)) This arrest underscores the persistent threat posed by ransomware groups like Phobos, which have targeted over 1,000 victims globally, including critical infrastructure sectors such as healthcare and education. The incident highlights the importance of international collaboration in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against evolving ransomware tactics. ([justice.gov](https://www.justice.gov/opa/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption?utm_source=openai))
5 months ago
Kill Chain
Poland's Crackdown on Phobos Ransomware: A 2026 Update
In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of 'Operation Aether,' an international effort coordinated by Europol targeting Phobos ransomware infrastructure and affiliates. During the operation, law enforcement seized computers and mobile phones containing stolen credentials, credit card numbers, and server access data, which could be used to facilitate ransomware attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/poland-arrests-suspect-linked-to-phobos-ransomware-operation/?utm_source=openai)) This arrest underscores the ongoing global efforts to dismantle ransomware operations and highlights the persistent threat posed by groups like Phobos. Organizations are reminded to bolster their cybersecurity defenses, particularly around Remote Desktop Protocol (RDP) configurations, to mitigate the risk of such attacks.
5 months ago
Kill Chain
Chinese Hackers Exploit Dell Zero-Day Vulnerability in 2024
In mid-2024, the Chinese state-sponsored hacking group UNC6201 began exploiting a critical vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines, a solution integral to VMware virtual machine backup and recovery. This hardcoded credential flaw allowed unauthenticated remote attackers to gain unauthorized access to the underlying operating system, achieving root-level persistence. Once inside, UNC6201 deployed advanced malware, including the Grimbolt backdoor, and utilized novel techniques like creating hidden network interfaces ('Ghost NICs') on VMware ESXi servers to move stealthily across networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))This incident underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure through zero-day vulnerabilities. The exploitation of such flaws highlights the necessity for organizations to maintain rigorous patch management and continuous monitoring to detect and mitigate sophisticated cyber threats.
5 months ago
Kill Chain
Critical Vulnerabilities in Popular VSCode Extensions Expose Developers to Attacks
In February 2026, critical vulnerabilities were discovered in several widely-used Visual Studio Code (VSCode) extensions, including Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview. These extensions, collectively downloaded over 128 million times, contained flaws that could be exploited to steal local files and execute remote code. The vulnerabilities were identified by Ox Security, which attempted disclosure since June 2025 without receiving responses from the maintainers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/flaws-in-popular-vscode-extensions-expose-developers-to-attacks/?utm_source=openai)) This incident underscores the escalating risks associated with third-party development tools and the necessity for rigorous security assessments of IDE extensions. The widespread adoption of these vulnerable extensions highlights the potential for significant supply chain attacks targeting developers and organizations.
5 months ago
Kill Chain
Microsoft Uncovers AI Recommendation Poisoning Threat
In February 2026, Microsoft disclosed a new cyber threat termed 'AI Recommendation Poisoning,' where businesses embed hidden instructions within 'Summarize with AI' buttons on their websites. When users click these buttons, the AI assistant's memory is manipulated via URL prompt parameters to favor certain companies or products in future recommendations. Over a 60-day period, Microsoft identified over 50 unique prompts from 31 companies across 14 industries, raising concerns about the integrity of AI-driven insights. This technique mirrors traditional search engine optimization (SEO) manipulation but targets AI systems directly, potentially leading to biased recommendations in critical areas such as health, finance, and security without user awareness. The emergence of AI Recommendation Poisoning underscores the evolving landscape of cyber threats targeting artificial intelligence systems. As AI becomes increasingly integrated into decision-making processes, ensuring the neutrality and reliability of AI outputs is paramount. Organizations must implement robust security measures to detect and prevent such manipulations to maintain trust in AI-driven recommendations.
5 months ago
Kill Chain
SmartLoader's Exploitation of Oura MCP Server: A 2026 Supply Chain Attack
In February 2026, cybersecurity researchers uncovered a sophisticated supply chain attack involving the SmartLoader malware. Threat actors cloned the legitimate Oura Model Context Protocol (MCP) Server—a tool connecting AI assistants to Oura Ring health data—and distributed a trojanized version through deceptive GitHub repositories. This malicious server delivered the StealC infostealer, enabling attackers to exfiltrate credentials, browser passwords, and cryptocurrency wallet data from compromised systems. The attackers meticulously built credibility by creating fake GitHub accounts and repositories, submitting the trojanized server to legitimate MCP registries, and excluding the original author from contributor lists, thereby deceiving users into downloading the compromised software. This incident underscores a growing trend where threat actors exploit trusted platforms and tools to infiltrate systems. The methodical approach of building credibility over months highlights the evolving sophistication of supply chain attacks, emphasizing the need for organizations to rigorously verify the authenticity of software sources and implement robust security reviews before integrating third-party tools.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports