✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
CISA Closes Era of Emergency Directives — Centralizes Federal Vulnerability Management in 2026
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) retired ten Emergency Directives (EDs) that had been issued between 2019 and 2024 to mitigate high-risk vulnerabilities including DNS tampering, Microsoft Exchange flaws, Print Spooler vulnerabilities, SolarWinds compromise, and other widely exploited threats. CISA's review determined that remediation was complete and these urgent directives are now covered under Binding Operational Directive 22-01—which requires agencies to rapidly patch known exploited vulnerabilities (KEVs) in accordance with stricter deadlines. This mass retirement signals a shift from fragmented, incident-driven orders to centralized, ongoing vulnerability management via the KEV catalog. This move is especially relevant as threat actors continue to exploit unpatched vulnerabilities with increasing speed and sophistication. CISA’s new guidance streamlines federal agencies’ response, setting an industry precedent for proactive vulnerability management and rapid patch cycles aligned with emerging regulatory pressure and rising adversary activity.
6 months ago
Kill Chain
Critical RCE Flaw in Trend Micro Apex Central Revealed and Patched
In January 2026, Trend Micro disclosed a critical remote code execution (RCE) vulnerability (CVE-2025-69258) in its Apex Central on-premises management console. The flaw allowed unauthenticated, remote attackers to achieve SYSTEM-level code execution by sending crafted messages to the MsgReceiver.exe process via TCP port 20001. Exploitation required no user interaction and leveraged a DLL injection via a LoadLibraryEx vulnerability. Successful exploits could give attackers control over endpoint security management, posing risks to network-wide defenses and compliance. This incident underscores the urgent need for rapid patching, especially for Internet-facing management consoles. Such remote code execution vulnerabilities are increasingly targeted by threat actors due to their high-impact potential, and regulatory scrutiny over software vulnerabilities in critical security products has intensified.
6 months ago
Kill Chain
Illinois DHS Exposes 700,000+ Residents in Years-long Data Misconfiguration
In September 2025, the Illinois Department of Human Services (IDHS) discovered a data exposure incident affecting nearly 700,000 residents, when maps containing sensitive information were found to be publicly accessible due to misconfigured privacy settings on a mapping website. The breach, which lasted for several years, involved the exposure of addresses, case numbers, demographic details, and medical assistance plan information for Medicaid and Medicare recipients (without names), as well as additional data including names for a smaller group of rehabilitation services clients. Upon discovery, IDHS promptly secured the exposed maps, reviewed affected materials, and implemented safeguards to prevent recurrence. This incident highlights the persistent risk of misconfiguration-based data exposures in public sector organizations, especially with increasing reliance on digital tools for data visualization and resource management. As regulatory scrutiny and public concern over privacy intensify, organizations must prioritize robust controls over platforms managing sensitive information.
6 months ago
Kill Chain
Critical RCE Vulnerability Exposes Trend Micro Apex Central (2026)
In January 2026, Trend Micro disclosed a critical security vulnerability (CVE-2025-69258, CVSS 9.8) in its on-premise Apex Central for Windows, allowing unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges. The flaw exploited a LoadLibraryEX vulnerability in the MsgReceiver.exe component, enabling attacker-controlled DLL injection via specially crafted messages sent over TCP port 20001. Two accompanying vulnerabilities (CVE-2025-69259 and CVE-2025-69260, CVSS 7.5) could permit denial-of-service attacks. The vulnerabilities impacted Apex Central installations below Build 7190 and were responsibly disclosed by Tenable in August 2025. Organizations were urged to patch immediately to prevent potential system compromise. This incident highlights ongoing risks from remote code execution vulnerabilities in security management platforms. Attackers increasingly target critical infrastructure using sophisticated message-based exploits, making timely patching and enhanced segmentation crucial, especially amid rising regulatory scrutiny and a surge in supply chain attacks.
6 months ago
Kill Chain
China-Linked Hackers Achieve VMware ESXi VM Escape with Zero-Days (2025)
In December 2025, security researchers discovered a sophisticated cyberattack attributed to Chinese-speaking threat actors who exploited three zero-day vulnerabilities in VMware ESXi (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226). The attackers gained initial access via a compromised SonicWall VPN appliance, followed by deploying a custom exploit toolkit designed to escape virtual machine isolation and compromise the hypervisor itself. Exploiting the flaws allowed attackers to run arbitrary code on the ESXi host, install persistent backdoors (via VSOCKpuppet), and potentially pave the way for ransomware or advanced persistent remote access, posing direct risks to organizations’ virtual infrastructure integrity. This incident highlights the increased sophistication of state-linked APT actors in targeting virtualization platforms using zero-day techniques and bypassing traditional detection methods. As organizations continue to rely on virtualization and hybrid cloud environments, vigilance around hypervisor and access point security is paramount in defending against similar high-impact threats.
6 months ago
Kill Chain
ChatGPT's 2026 ZombieAgent Attack: Persistent Prompt Injection Exploits AI Memory
In January 2026, researchers at Radware disclosed a critical vulnerability in OpenAI's ChatGPT platform, exploiting its new memory and connector features via indirect prompt injection (IPI). The exploit, dubbed "ZombieAgent," allowed attackers to persistently implant malicious prompts within ChatGPT's memory using innocuous-looking emails or document attachments. Once infected, the AI could automatically extract and exfiltrate sensitive information through obfuscated URL requests whenever the user interacted with the compromised bot, bypassing existing controls and traditional user awareness. The attack method leverages ChatGPT integrations with email and third-party applications, increasing the risk of wide propagation and persistence. This incident underscores the rapidly evolving threat landscape in AI/ML security, where feature enhancements such as memory and connectivity can be leveraged by attackers for new classes of attacks. The ZombieAgent case highlights the urgent need for robust prompt source attribution, intent verification, and granular trust boundaries in AI agents as attackers adapt known abuse techniques to advanced AI capabilities.
6 months ago
Kill Chain
HPE OneView Critical Zero-Day Exploited for Remote Access in 2025
In June 2025, a critical vulnerability (CVE-2025-37164), was discovered and exploited in the wild against HPE OneView, the company’s IT infrastructure management platform. Attackers leveraged the flaw to achieve remote code execution without authentication, enabling full access to core infrastructure resources. Reported incidents indicate that threat actors used this vulnerability for initial access, privilege escalation, and potentially data exfiltration or ransomware deployment, threatening operational continuity for affected enterprises. HPE acted swiftly to release security advisories and patches, but exploitation occurred before widespread remediation could be implemented. This incident highlights the persistent targeting of critical infrastructure management tools and the increasing sophistication and speed with which attackers weaponize disclosed zero-day vulnerabilities. Organizations must prioritize patch management and vigilant monitoring to prevent compromise in an evolving landscape of high-consequence supply chain and platform attacks.
6 months ago
Kill Chain
How Attackers Manipulate Windows Process Environment Blocks for Evasion (2024 Analysis)
In January 2024, security researchers highlighted a process manipulation technique in Windows environments that allows attackers to modify the Process Environment Block (PEB) of malicious or legitimate processes. By leveraging the CREATE_SUSPENDED flag and directly editing the PEB structure, adversaries can spoof or hide command-line arguments of spawned processes. This method can be further extended to already-running processes, making detection through simple process inspection more challenging. The primary risk lies in attackers masking their operational activities to evade security controls and digital forensics investigation. This incident underscores the evolving sophistication of post-exploitation tactics aimed at defense evasion. Process hollowing, command-line spoofing, and direct PEB tampering are increasingly used in targeted attacks and commodity malware alike, highlighting the critical need for visibility, anomaly detection, and strong endpoint security strategies.
6 months ago
Kill Chain
CISA Flags Critical HPE OneView Vulnerability as Actively Exploited in 2026
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged a critical vulnerability (CVE-2025-37164) in HPE OneView infrastructure management software as being actively exploited in the wild. This flaw, present in versions prior to 11.00, allows unauthenticated attackers to execute low-complexity code-injection attacks, gaining remote code execution on unpatched systems. HPE issued security updates in December 2025, but as no mitigations or workarounds exist, organizations using legacy versions remain exposed. The exploitation of this vulnerability poses significant risks to IT infrastructure due to OneView’s widespread enterprise adoption, which includes the Fortune 500. The prominence of this threat highlights a growing trend in attacks targeting centralized infrastructure management platforms, often leading to widespread lateral movement and potential operational disruption. Regulatory agencies and security teams are increasingly prioritizing rapid patching and zero trust segmentation to address these critical exposures.
6 months ago
Kill Chain
Cisco 2026 ISE Vulnerability: How Public Exploits Undermine Zero Trust
In January 2026, Cisco disclosed a critical vulnerability (CVE-2026-20029) affecting its widely used Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw, caused by improper XML parsing in the web-based management interface, allows attackers with valid administrative credentials to upload a malicious file and access otherwise restricted files on the underlying operating system. While Cisco has not identified any active exploitation in the wild, proof-of-concept exploit code is publicly available and even privileged enterprise environments are exposed until patched. Administrators manage authentication, access, and segmentation policies through ISE, so exploitation could grant attackers access to highly sensitive network information or credentials, potentially undermining zero trust controls and compliance postures. This incident is particularly relevant as it highlights the ongoing risk posed by public exploit code, privilege escalation bugs, and gaps in patch hygiene for critical access-management tools. Increased regulatory scrutiny and the sophistication of attackers targeting identity and segmentation controls mean organizations cannot delay patching or segmentation efforts, especially as similar vulnerabilities continue to be a primary vector for advanced threats.
6 months ago
Kill Chain
Global Cisco Switch Reboot Outage: DNS Client Vulnerability Hits Network Operations
In January 2026, numerous Cisco network switches globally experienced widespread, persistent reboot loops due to a software vulnerability in their DNS client service. Beginning around 2 AM UTC, administrators observed affected Cisco models—including CBS250, CBS350, SG350, SG350X, SG550X, and Catalyst C1200—entering repeated crashes when DNS queries for core domains (such as www.cisco.com or NTP servers) failed. The root trigger appears to be a firmware bug in the DNSC task, causing the switch OS to log a critical error and initiate an immediate reboot, with impacts observed across multiple organizations and networks worldwide. Temporary mitigations, such as disabling DNS or SNTP features, helped restore partial stability until Cisco and upstream CDN providers reverted the changes. The incident highlights the ongoing risk that latent software vulnerabilities in ubiquitous infrastructure devices pose to business continuity. As device automation and remote management expand, similar vulnerabilities can cause cascading operational outages across sectors, underscoring the need for robust patching, rigorous QA in embedded systems, and improved visibility over east-west traffic disruptions.
6 months ago
Kill Chain
Chinese APT Exploits VMware ESXi Zero-Days in Stealth Hypervisor Attacks (2025)
In late 2025, threat researchers identified a series of intrusions targeting VMware ESXi hypervisors via a zero-day toolkit attributed to a Chinese-speaking advanced persistent threat group. The attackers initially gained access by compromising a SonicWall VPN device and pivoted through privileged domain accounts, leveraging sophisticated VM escape exploits that chained three ESXi zero-day vulnerabilities (CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225) developed more than a year before disclosure. The exploit chain enabled lateral movement, data staging for exfiltration, and installation of stealth persistence backdoors, placing numerous enterprise virtualization environments at sustained risk for data breach and operational disruption. This incident exemplifies the escalating sophistication of APT operations, underlining the risks posed by supply chain weaknesses, late vulnerability reporting, and the ability of attackers to evade common monitoring. The case also highlights growing regulatory scrutiny on zero-day management and east-west traffic visibility within critical infrastructure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports