✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
INC Ransomware OpSec Fail Uncovers Data from 12 U.S. Organizations
In January 2026, an operational security lapse in the INC ransomware group's infrastructure enabled Cyber Centaurs researchers to recover encrypted data exfiltrated from twelve U.S. organizations. The investigation began after a RainINC ransomware attack on a client’s production SQL Server. Forensic analysis traced renamed binaries, PowerShell scripts, and usage of the Restic backup tool, revealing attacker scripts with hardcoded credentials and references to persistent cloud storage. By enumerating the attacker-controlled repositories, researchers identified encrypted data from healthcare, manufacturing, technology, and services firms, then decrypted and preserved it in coordination with law enforcement. This case highlights a rare opportunity where attacker mistakes allowed post-breach data retrieval for unrelated victim organizations. The incident underscores a growing trend in ransomware operations leveraging legitimate backup and exfiltration tools, persistent attacker infrastructure, and the importance of thorough incident response for uncovering wider impacts.
6 months ago
Kill Chain
SmarterMail Auth Bypass Allows Attackers to Reset Admin Accounts in Live Exploits
In January 2026, attackers began exploiting an authentication bypass vulnerability in SmarterTools’ SmarterMail email server platform, which enabled unauthenticated users to reset admin account passwords and seize full system control. The flaw, residing in a publicly-exposed API endpoint allowing forced resets with attacker-supplied JSON, let threat actors escalate privileges by resetting admin credentials, paving the way to remote code execution. The vulnerability was disclosed in early January, patched on January 15, and observed in active exploitation just days later as attackers reverse-engineered the fix to target unpatched servers globally. This incident draws attention to the criticality of prompt patch management and highlights the ongoing risk of API flaws being rapidly weaponized post-disclosure. It underscores a broader trend of attackers targeting authentication controls in business-critical SaaS and infrastructure applications, raising regulatory and operational pressure for stronger access security and rapid response procedures.
6 months ago
Kill Chain
Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)
In January 2026, threat actors exploited misconfigured web applications used for security testing and internal penetration testing—such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP—publicly exposed by Fortune 500 companies and major security vendors. By targeting these intentionally vulnerable apps tied to overly privileged cloud accounts in AWS, GCP, and Azure, attackers gained unauthorized access, deployed Monero (XMR) crypto miners, planted persistent webshells, and pivoted to sensitive cloud assets. Over 1,900 instances were found online, many with default credentials and excessive permissions, exposing secrets and allowing full access to cloud resources including storage buckets and Secrets Manager. Victim organizations remediated after being notified. This incident highlights a growing attack pattern where "friendly" security test and training tools become high-risk assets when mismanaged in cloud environments. Their exploitation underscores pressing gaps in cloud inventory management, IAM least-privilege enforcement, and secret sprawl, at a time of escalating attacks exploiting cloud misconfiguration and supply chain weaknesses.
6 months ago
Kill Chain
Why Even Security Pros Get Phished: The Human & AI-Powered Phishing Crisis of 2026
In January 2026, multiple incidents highlighted how even vigilant individuals and cybersecurity professionals are susceptible to highly convincing phishing attacks. Attackers leveraged advanced social engineering techniques and sophisticated phishing-as-a-service (PhaaS) platforms, often enhanced by AI-driven content generators such as PhishGPT, to deliver targeted messages via email, SMS, and collaboration tools. These lures bypassed traditional defenses, exploiting moments of distraction or emotional vulnerability to harvest sensitive information including credentials and payment data. The operational impact ranged from financial loss and credential compromise to downstream business risk due to unauthorized access or fraud. The incident typifies the evolution of phishing as an industrialized, scalable ecosystem that increasingly relies on automation, AI-tailored content, and a broadening array of tactics. As these methods proliferate and become accessible to attackers with limited technical skills, organizations face heightened regulatory, operational, and reputational risks, making effective prevention and user awareness more vital than ever.
6 months ago
Kill Chain
Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts
In January 2026, LastPass warned users of a sophisticated phishing campaign impersonating official maintenance notifications, urging recipients to back up their password vaults within 24 hours. Attackers crafted convincing emails from spoofed senders with subjects stressing urgency, redirecting victims to a phishing site designed to harvest master passwords or hijack accounts. The campaign coincided with a U.S. holiday weekend, likely aiming to exploit periods of reduced staffing for more effective compromise. The prompt and widespread phishing attempt risked exposure of highly sensitive personal and business credentials, threatening downstream impacts and increased support demand for affected users and organizations. This incident highlights the ongoing evolution of credential harvesting campaigns and demonstrates how adversaries exploit times of operational vulnerability. The use of realistic messages and urgency tactics exemplifies broader trends in social engineering, reinforcing the necessity for user education, resilient authentication practices, and rapid response protocols to counteract increasingly common and dangerous phishing threats targeting password managers.
6 months ago
Kill Chain
Patched Fortinet Firewalls Breached in 2026: Authentication Bypass Exposes Enterprise Networks
In January 2026, patched FortiGate firewalls running FortiOS versions 7.4.9 and 7.4.10 were actively breached due to exploitation of a lingering authentication bypass flaw (CVE-2025-59718) in the FortiCloud SSO login feature. Despite an earlier patch, attackers utilized crafted SAML messages to create rogue admin accounts on exposed devices, as observed in customer logs and confirmed by Fortinet developers. More than 11,000 Internet-facing Fortinet devices remained vulnerable as attackers leveraged the flaw to gain privileged access and potentially compromise network defenses, triggering urgent remediation efforts. This incident underscores persisting risks from incomplete remediation, especially on security appliances pivotal to organizational defenses. Growing attacker expertise in exploiting authentication logic flaws and a surge in identity-based attacks highlight the necessity for ongoing vigilance, layered compensating controls, and rapid vulnerability response strategies.
6 months ago
Kill Chain
CERT/CC Alert: binary-parser npm Vulnerability Puts Node.js Apps at Risk
In November 2025, a critical vulnerability (CVE-2026-1245) was disclosed in the widely used binary-parser npm library, enabling attackers to execute arbitrary JavaScript code on impacted Node.js applications. The issue stemmed from unsanitized user-supplied values in dynamically generated parser code, leaving systems relying on untrusted parser definitions open to privilege-level code execution and potential compromise of local data, application logic, or even execution of system commands. CERT/CC publicly warned about this supply-chain risk, urging organizations to upgrade to binary-parser v2.3.0 and avoid processing untrusted parser configurations. This incident is a stark reminder of the supply-chain risks inherent in open-source dependencies, especially those that permit dynamic code generation. As exploitation of package vulnerabilities continues to rise, regulators and CISOs are placing increasing importance on proactive dependency management and runtime validation in development and DevOps pipelines.
6 months ago
Kill Chain
Chainlit 2026 Supply-Chain Flaws Let Hackers Breach Cloud AI Environments
In early 2026, two high-severity vulnerabilities ('ChainLeak') were discovered in Chainlit, a widely adopted open-source conversational AI framework, exposing cloud environments to significant risk. The flaws—CVE-2026-22218 (arbitrary file read) and CVE-2026-22219 (server-side request forgery)—could be exploited without user interaction, allowing attackers to access sensitive files and internal services on internet-facing production systems. Zafran Labs demonstrated that chaining both vulnerabilities enabled full-system compromise and lateral movement within enterprise cloud environments before a patch (v2.9.4) was released in December 2025. This incident highlights a growing threat vector in the AI software supply chain, especially as critical business and academic applications increasingly rely on rapidly evolving open-source frameworks. With adversaries targeting common components and fast-moving cloud deployments, organizations face pressure to update promptly and re-evaluate their security posture against similar zero-day and supply-chain risks.
6 months ago
Kill Chain
Cisco Zero-Day Exploited: Critical Remote Code Execution in Unified Communications (2026)
In January 2026, Cisco disclosed and patched CVE-2026-20045, a critical zero-day vulnerability affecting Unified Communications Manager, Unity Connection, and Webex Calling Dedicated Instance platforms. The flaw, arising from improper validation of user-supplied input via HTTP requests, allowed unauthenticated attackers to execute arbitrary code and escalate privileges to root on impacted servers. Cisco’s Product Security Incident Response Team (PSIRT) confirmed in-the-wild exploitation prior to patch release and issued urgent guidance for customers to update, as no workarounds exist. The U.S. CISA swiftly added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating timely remediation for federal agencies. This incident highlights a broader trend of sophisticated zero-day attacks targeting enterprise communications infrastructure. As attackers increasingly focus on supply chain and collaboration platforms, organizations must maintain rapid patching practices and improve segmentation and detection mechanisms against privilege escalation and remote code execution threats.
6 months ago
Kill Chain
Phishing Campaign Impersonates LastPass, Targets Master Passwords in 2026
In January 2026, LastPass alerted its users to an active and sophisticated phishing campaign impersonating the company, which sought to trick users into revealing their master passwords. Attackers sent urgent emails—claiming to be scheduled maintenance reminders—directing recipients to phishing sites designed to harvest their credentials. The emails originated from deceptive domains and included subject lines urging immediate backup of password vaults. LastPass emphasized to its users that it does not request master passwords and worked swiftly with partners to dismantle the malicious infrastructure, mitigating immediate risk. This incident highlights the persistent evolution of phishing tactics, particularly those exploiting brand trust and sense of urgency. As password manager adoption grows, attackers increasingly target such platforms, intensifying the need for user vigilance and robust email security controls.
6 months ago
Kill Chain
VoidLink: The First AI-Generated Linux Malware Framework Exposes New Cybersecurity Risks
In late 2025, cybersecurity researchers uncovered VoidLink, a sophisticated Linux malware framework reportedly developed primarily by a single actor leveraging artificial intelligence. Analyses by Check Point Research and Sysdig identified operational artifacts and systematic code features—like consistent formatting, template-based responses, and AI-generated debug logs—suggesting heavy use of large language models in the malware’s rapid development. The threat actor, operating in a Chinese-language environment, utilized AI tools such as TRAE SOLO to expedite Spec Driven Development, producing 88,000 lines of attack-ready code in less than a week. While no real-world infections have been reported to date, VoidLink’s capabilities are significant, aiming at stealthy, long-term access to Linux-based cloud infrastructure. The emergence of AI-generated attack frameworks like VoidLink signals a pivotal change in cybercrime. Advanced threat creation, once limited to state actors or skilled teams, can now be accomplished rapidly by individuals utilizing off-the-shelf AI tools. This trend increases the urgency for organizations to adapt AI-enhanced defenses and revisit zero trust, segmentation, and cloud security controls.
6 months ago
Kill Chain
Zoom & GitLab Issue Critical Security Patches for RCE, DoS, and 2FA Bypass—January 2026
In January 2026, Zoom and GitLab simultaneously released critical security updates to mitigate multiple high-severity vulnerabilities uncovered in their respective platforms. Zoom's most impactful flaw, CVE-2026-22844 (CVSS 9.9), affected its Node Multimedia Routers (MMRs), potentially enabling a meeting participant to perform remote code execution via a command injection. GitLab, meanwhile, addressed several vulnerabilities including two denial-of-service (DoS) issues and a two-factor authentication (2FA) bypass flaw (CVE-2026-0723), which could let malicious actors disrupt services or compromise user accounts if they knew credential IDs. While no active exploitation was reported, organizations using Zoom’s Node MMR module and GitLab’s CE/EE deployments were urged to patch immediately to avoid significant business disruption or data compromise. The disclosure of these vulnerabilities highlights the increasing sophistication and severity of threats targeting software supply chains and critical collaboration platforms. With attackers frequently seeking novel vectors for RCE, DoS, and authentication bypass, timely patching and robust segmentation remain crucial.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports