✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
React2Shell and the December 2025 CVE Tsunami: Multi-Vector Exploitation at Scale
In December 2025, a record-setting wave of critical vulnerabilities led to a 120% surge in high-severity exploits globally, with 22 CVEs actively targeted—double the previous month. The standout event was the mass exploitation of Meta's React Server Components (CVE-2025-55182, dubbed "React2Shell"), which allowed unauthenticated remote code execution and became a magnet for a variety of threat actors, including China-linked groups Earth Lamia and Jackpot Panda plus a mix of financially motivated and state-aligned attackers. Attackers leveraged new and legacy vulnerabilities to deploy malware, pivot across internal networks, and compromise key infrastructure across vendors like Google, Fortinet, Cisco, Microsoft, and more. The incident highlights a dangerous shift: modern web frameworks are becoming high-value targets, attack toolkits are rapidly weaponizing zero-days, and threat actors now freely cycle between old and new vulnerabilities. Organizations operating React/Next.js or affected platforms face urgent patching requirements amid heightened regulatory attention and persistent adversarial activity.
6 months ago
Kill Chain
2024 Ransomware Attack on Global Utility: Speed, Sophistication, and Credential Theft
In March 2024, a leading global utility company suffered a large-scale ransomware attack executed by the BlackBasta threat group. Attackers initially gained entry by exploiting an externally-facing VPN with compromised credentials, bypassing multifactor authentication controls. Upon entry, the threat actors rapidly performed reconnaissance, escalated privileges, and moved laterally using legitimate remote management tools and credential dumping techniques, deploying ransomware payloads across hundreds of critical systems within 48 hours. The incident resulted in massive operational disruptions, including temporary shutdowns of power generation facilities and significant data exfiltration, while the attackers leveraged double extortion to pressure the company into paying a multimillion-dollar ransom. This breach exemplifies the growing sophistication and speed of multi-stage ransomware campaigns targeting critical infrastructure. The incident highlights the importance of pre-encryption detection, intelligence-driven defense, and robust access controls as ransomware groups continue to exploit hybrid environments and rapidly weaponize vulnerabilities.
6 months ago
Kill Chain
CISA Flags Critical Exploited Windows Vulnerability: CVE-2026-20805
In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20805, a Microsoft Windows Information Disclosure Vulnerability, to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation. Attackers have leveraged this vulnerability as an entry vector to access sensitive data from federal and private sector Windows machines, potentially exposing unencrypted or inadequately protected data in transit. The incident highlights the ongoing risk to government and enterprise environments from timely, opportunistic exploitation of unpatched known vulnerabilities, particularly those enabling information disclosure and lateral movement within networks. This addition to CISA’s KEV Catalog underscores intensifying efforts by cybercriminals to rapidly weaponize newly disclosed vulnerabilities, especially those impacting widely-deployed products like Microsoft Windows. Regulatory and operational pressure is mounting for organizations to accelerate remediation practices as adversaries increasingly automate exploitation processes.
6 months ago
Kill Chain
YoSmart YoLink 2026: IoT Flaws Enable Remote Takeover and Data Exposure
In January 2026, YoSmart's YoLink Smart Hub platform was found vulnerable to a series of security flaws that placed smart home users at risk worldwide. Discovered and reported by Bishop Fox and disclosed via CISA, these issues included insufficient authorization in device communication, the use of predictable device identifiers, cleartext transmission of sensitive information over MQTT, and excessive session token lifetimes. Attackers could remotely control users' smart devices, intercept data, and hijack sessions without physical access, affecting both the hub and its mobile app ecosystem. The vulnerabilities were present in core server infrastructure, device APIs, and user-facing applications. While YoSmart resolved the vulnerabilities through server-side and over-the-air updates, this incident highlights critical and ongoing risks in the IoT and smart device sector. The attack methods exploited insecure-by-design communication and poor identity management—trends increasingly scrutinized by regulators and targeted by sophisticated threat actors worldwide.
6 months ago
Kill Chain
GoBruteforcer Botnet Hits 50K+ Linux Servers with AI-Powered Brute Force
In early 2024, researchers identified a powerful new variant of the GoBruteforcer botnet actively targeting over 50,000 Linux servers worldwide. The attackers leveraged automated brute-force attacks in combination with AI-generated configurations to compromise servers running popular services such as SSH, MySQL, and Redis. Once inside, the botnet deployed additional malware to expand its network, launch further attacks, and facilitate potential data theft or service disruption, posing significant operational risks to exposed organizations. This campaign highlights the evolving nature of automated botnets, now leveraging AI tools to speed up attacks and evade detection. With Linux servers widely used in cloud and enterprise environments, the incident underscores the urgent need for improved credential hygiene, segmentation, and real-time traffic monitoring as botnets increasingly target critical infrastructure at scale.
6 months ago
Kill Chain
How Attackers Used Python and Cloudflare to Deploy AsyncRAT in 2024
In mid-2024, cybersecurity researchers uncovered a sophisticated phishing campaign in which threat actors leveraged Python scripts and the Cloudflare platform to distribute the AsyncRAT remote access trojan (RAT). Attackers crafted convincing email lures that enticed recipients to execute supplied Python scripts, which subsequently contacted Cloudflare infrastructure to retrieve further payloads. The use of legitimate services such as Cloudflare enabled the attackers to bypass conventional security controls, effectively concealing command-and-control traffic and deploying malware without immediate detection. The campaign facilitated remote access to victim systems, data exfiltration, and the potential for lateral movement within compromised networks. This incident underscores a continuing trend in which malicious actors abuse reputable cloud and open source ecosystems to deliver payloads and evade traditional defenses. Organizations across sectors must remain vigilant as threat groups increasingly weaponize trusted platforms and novel delivery mechanisms.
6 months ago
Kill Chain
Supply Chain RCE Threats in Leading AI/ML Python Libraries (2025-2026)
In January 2026, significant remote code execution (RCE) vulnerabilities were disclosed across leading open-source AI/ML Python libraries maintained by NVIDIA (NeMo), Salesforce (uni2TS), and Apple (ml-flextok). Attackers could craft malicious model files with compromised metadata; upon loading these files via vulnerable libraries, arbitrary code would execute on the host system. These vulnerabilities stemmed from insecure use of third-party serialization/configuration functions—primarily Hydra's instantiate()—without proper validation, enabling supply chain attacks on widely distributed AI models, particularly via public repositories such as HuggingFace. No in-the-wild exploits were confirmed before public disclosure; however, the affected vendors coordinated prompt patches and mitigations throughout 2025. This incident illustrates a growing trend of software supply chain threats cascading into the AI/ML ecosystem. With increased adoption of AI and routine sharing of pretrained models, even safe-seeming formats may introduce unseen risks, underscoring the urgency for security controls, vigilance in model sourcing, and rapid adaptation of secure-by-design principles for both model creators and consumers.
6 months ago
Kill Chain
Critical Ni8mare Flaw Exposes 60,000+ n8n Instances to Remote Exploitation
In January 2026, a critical vulnerability tracked as CVE-2026-21858, dubbed "Ni8mare," was disclosed in n8n, the widely-used open-source workflow automation platform. The flaw, rooted in improper input validation of form file elements, allows unauthenticated remote attackers to seize control of exposed n8n instances by exploiting online workflows. This exposure places sensitive credentials, API keys, and business data at risk across nearly 60,000 instances, with especially high concentrations in the US and Europe. The vulnerability can lead to credential theft, privilege escalation, and even arbitrary command execution, depending on instance configuration. This incident is highly relevant given the broad adoption of low-code and automation platforms in AI and DevOps workflows, making them attractive targets for attackers seeking lateral movement or data exfiltration. The ongoing exposure of thousands of n8n servers underscores the urgent need for robust vulnerability management and secure configuration in automation environments.
6 months ago
Kill Chain
2025 University of Hawaii Cancer Center Ransomware Breach: Research Data Compromised
In August 2025, the University of Hawaii Cancer Center experienced a ransomware incident that resulted in threat actors encrypting systems associated with a specific research project. The intrusion led to the exfiltration and encryption of files, some of which dated back to the 1990s and included research participant data containing Social Security numbers, predating modern de-identification practices. While only research files and not clinical or patient treatment data were affected, the disruption necessitated a comprehensive remediation effort including system replacements, forensic investigations, ransomware payment for decryption, and negotiations for deletion of exfiltrated information. This incident underscores the targeting of higher-education and research organizations by ransomware attackers seeking both data and financial gain. With universities increasingly storing decades-old PII, and ransomware groups escalating both exfiltration and extortion, the breach exemplifies the urgency of robust detection, legacy data management, and compliance disciplines in the education and research sector.
6 months ago
Kill Chain
Gogs Path Traversal CVE-2025-8110: Active Exploitation Prompts CISA KEV Inclusion
In January 2026, CISA issued an alert adding CVE-2025-8110 to its Known Exploited Vulnerabilities Catalog after confirming active exploitation of a critical path traversal vulnerability in Gogs, a popular self-hosted Git service. Threat actors leveraged this flaw to bypass directory security controls, allowing unauthorized access to sensitive files and potentially facilitating lateral movement, data exfiltration, or the deployment of malicious code in affected federal and private sector organizations. In accordance with Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were ordered to remediate this vulnerability immediately to stem ongoing exploitation risks and protect government infrastructure. The ongoing exploitation of CVE-2025-8110 highlights a growing trend of attackers targeting unmanaged or overlooked developer infrastructure for initial access. The incident underscores regulatory and operational pressure for timely vulnerability management and demonstrates the criticality of securing east-west application flows.
6 months ago
Kill Chain
Two Major Campaigns Expose AI/LLM Endpoint Security Flaws in 2024
In early 2024, security researchers observed two distinct attack campaigns targeting more than 91,000 public Large Language Model (LLM) endpoints. Threat actors systematically scanned for exposed LLM interfaces left accessible on the public internet, leveraging them to probe for sensitive data leaks and map organizational attack surfaces. Attackers exploited the unprotected AI endpoints primarily through direct web probes and API requests, taking advantage of lax access controls and lack of encryption. The business impact included the risk of sensitive internal data exposure, increased surface area for lateral movement, and potential regulatory non-compliance. The incident highlights the increasing threat to organizations deploying AI/GenAI technologies without robust security controls. As adoption of LLMs surges, attackers are pivoting to exploit these modern interfaces, driving urgency for enterprises to secure AI assets, enforce segmentation, and monitor for unauthorized use of LLM endpoints.
6 months ago
Kill Chain
Researchers Uncover How Subtle Tuning Can Corrupt LLMs via Inductive Backdoors
In January 2026, researchers published a pivotal study revealing new ways that adversaries can corrupt large language models (LLMs) through subtle data poisoning and finetuning techniques that exploit the models’ generalization abilities. The research demonstrated that minimal, targeted finetuning can induce LLMs to adopt outdated or harmful behaviors even outside the initial scope of manipulation. Notably, the study introduced the concept of "inductive backdoors," wherein LLMs generalize a malicious trigger and behavior relationship—resulting in broad, unpredictable misalignments and persona shifts not directly present in the source training data. No direct attacker, but the techniques expose exploitable weaknesses in LLM training pipelines and data supply chain security. This finding is urgent for organizations integrating AI/ML into business operations. It spotlights a new class of supply chain and insider risk: even small, unnoticed changes in model inputs or fine-tuning datasets can profoundly undermine trust, safety, and regulatory compliance in deployed AI systems.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports