✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Inside the Scattered Lapsus$ Honeypot: How Researchers Turned the Tables in 2024
In early 2024, cybersecurity researchers staged a sophisticated deception operation targeting Scattered Lapsus$, also known as ShinyHunters, by deploying a realistic but fake dataset as a honeypot. The operation was designed to lure threat actors with what appeared to be sensitive credentials and data, allowing security experts to monitor the attackers' methods and behaviors in real time. Once engaged, Scattered Lapsus$ actors attempted lateral movement and data exfiltration using various covert tools and techniques, but their actions were closely tracked and documented. This resulted in a rare glimpse into the group's tactics, techniques, and procedures, as well as validation of multiple defensive controls. This incident is particularly noteworthy as it demonstrates the growing effectiveness of proactive threat intelligence gathering through deception and honeypots. With threat groups like Lapsus$ and ShinyHunters targeting high-value data across industries, similar methods are being adopted by defenders to preemptively understand and disrupt sophisticated adversaries.
6 months ago
Kill Chain
Zestix Credential Heist: 2024 Cloud Infostealer Campaign Exposes MFA Weaknesses
In early 2024, a novel threat actor known as "Zestix" orchestrated a widespread credential theft campaign targeting enterprise file-sharing environments across multiple sectors. Using advanced infostealer malware, Zestix harvested cloud credentials at scale, exploiting organizations that had not enforced multi-factor authentication (MFA). The attackers subsequently gained unauthorized access to sensitive files and regulated business data from approximately 50 companies, causing both data exfiltration and operational disruptions. The breach underlines significant weaknesses in authentication and access controls within cloud ecosystems, with impacts ranging from compromised intellectual property to potential compliance violations. The incident underscores the urgent need for robust access controls and MFA as essential defenses in today’s cloud-first environments. With identity-driven breaches rising and attackers automating large-scale infostealer campaigns, organizations face increasing regulatory and reputational pressure to modernize and enforce cloud security policies.
6 months ago
Kill Chain
Innovative Phishing Campaign Evades Detection with HTML Table-Based QR Codes
In late December 2023, a novel phishing campaign was observed in which attackers delivered emails containing QR codes crafted not from traditional images, but rendered using HTML tables. The campaign targeted end users with messages between December 22nd and December 26th, embedding visually normal but technically 'imageless' QR codes. When scanned, these QR codes redirected victims to phishing domains customized per recipient, aiming to harvest credentials. By sidestepping standard image-based security controls, these emails successfully bypassed common email security gateways designed to detect embedded malicious QR codes. This incident highlights adversary innovation in evading current email security technologies by exploiting overlooked content formats. It underscores ongoing risks as attackers adapt tactics to defeat both legacy and modern defensive controls. As sophisticated phishing methods proliferate, organizations must focus on layered defenses and continuous user education.
6 months ago
Kill Chain
Generative AI Supercharges Active Directory Credential Attacks in 2026
In early 2026, organizations relying on Microsoft Active Directory experienced a significant increase in successful identity attacks fueled by generative AI technology. Threat actors leveraged AI-powered password cracking tools, such as PassGAN, capable of predicting and cracking user passwords with unprecedented speed, particularly by exploiting patterns present in common password creation habits. These attackers combined automated reconnaissance—scraping public data with large language models—to generate highly targeted guesses, accelerating credential compromise, and enabling lateral movement within corporate networks. Weak password policies, reliance on basic MFA, and the wide availability of cost-effective GPU resources contributed to the scale and efficiency of these breaches. This incident highlights the urgent need for organizations to address evolving attack methodologies, as generative AI lowers the technical barrier for credential-focused attacks and shortens breach timetables. The cybersecurity landscape is rapidly shifting towards identity-driven threats facilitated by AI, demanding stronger, adaptive protections to prevent widespread compromise.
6 months ago
Kill Chain
Critical n8n Vulnerability Enables Authenticated Command Execution (CVE-2025-68668)
In January 2026, a critical vulnerability (CVE-2025-68668) was disclosed in n8n, an open-source workflow automation platform, allowing authenticated users with workflow modification privileges to execute arbitrary system commands on the host server. The flaw, caused by a sandbox bypass in the Python Code Node (Pyodide), impacted all n8n versions from 1.0.0 up to 2.0.0. Prompted by Cyera Research Labs’ findings, the n8n team released version 2.0.0 as a fix and advised urgent security configuration changes or feature disablement as interim measures. The vulnerability poses high risks for supply-chain and SaaS environments using n8n in production, potentially enabling lateral movement or privilege escalation. This incident underscores the continued threat from vulnerabilities in low-code/no-code and automation platforms, especially as attackers increasingly leverage authenticated access and workflow manipulation to escalate privileges. Organizations should review security settings of workflow platforms due to a growing pattern of exploitation in automation pipelines.
6 months ago
Kill Chain
VS Code Forks Highlight Open VSX Supply Chain Vulnerability (2026)
In early 2026, a supply chain vulnerability involving popular AI-powered Visual Studio Code (VS Code) forks—such as Cursor, Windsurf, Google Antigravity, and Trae—was discovered. These IDEs recommended certain extensions that did not exist in the Open VSX registry, leaving the extension namespaces unclaimed and thus open to exploitation by malicious actors. Attackers could upload rogue extensions under these names, which unsuspecting developers would install due to these recommendations. Koi researchers demonstrated the risk by publishing a placeholder PostgreSQL extension on Open VSX, garnering over 500 installs, highlighting the real-world likelihood of sensitive data exposure and credential theft before the issue was mitigated by the IDE vendors and Open VSX registry maintainers. This incident underscores the persistent risk of supply chain attacks in open-source developer tooling, as adversaries increasingly exploit gaps in public code marketplaces. With threat actors targeting trusted workflows and dependency chains, organizations must elevate their scrutiny and controls around open-source software consumption.
6 months ago
Kill Chain
Critical AdonisJS Bodyparser Flaw Exposes Servers to Arbitrary File Write (CVE-2026-21440)
In January 2026, a critical vulnerability (CVE-2026-21440, CVSS 9.2) was disclosed in the widely-used @adonisjs/bodyparser npm package, a foundational component for handling multipart form data in AdonisJS applications. The flaw, attributed to improper validation of user-supplied input, allowed remote attackers to exploit a path traversal bug, thereby enabling arbitrary file writes to affected servers. Successful exploitation could ultimately lead to full system compromise, data breach or destructive attacks, due to the broad permissions often held by server-side runtimes. The risk was amplified by the widespread use of AdonisJS across SaaS, fintech, and e-commerce platforms. This incident underscores broader supply-chain security concerns impacting open-source software ecosystems. Attackers are aggressively targeting commonly used packages to gain upstream access, making robust dependency management, real-time vulnerability monitoring, and rapid patch adoption vital defensive practices for modern development teams.
6 months ago
Kill Chain
TOTOLINK EX200 Unpatched Flaw Enables Remote Takeover in 2026
In January 2026, a critical unpatched firmware vulnerability (CVE-2025-65606) was disclosed by CERT/CC affecting TOTOLINK EX200 wireless range extenders. This flaw resides in the device’s firmware-upload error-handling logic, allowing a remote authenticated attacker to trigger processes leading to full device compromise. Successful exploitation provides total administrative control, enabling attackers to alter configurations, secretly listen to traffic, or pivot to other devices on the network. TOTOLINK has not released an update, leaving vulnerable devices exposed in both home and enterprise environments. This breach highlights the ongoing threat posed by IoT device vulnerabilities—especially as attackers increasingly exploit authentication-bypass flaws and manufacturer patch delays. The incident underscores the importance of swift vulnerability management and robust network segmentation in mitigating the risk from unpatched IoT endpoints.
6 months ago
Kill Chain
900,000 Users Targeted: Malicious Chrome Extensions Harvest AI Chat & Browser Data
In January 2026, cybersecurity researchers uncovered two malicious Chrome extensions—'Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI' and 'AI Sidebar with Deepseek, ChatGPT, Claude, and more.'—that secretly exfiltrated ChatGPT, DeepSeek conversations, and extensive browsing data from over 900,000 users. These extensions masqueraded as legitimate browser tools but harvested sensitive data by scraping web pages and Chrome tabs, transmitting this information to attacker-controlled command-and-control servers every 30 minutes. This breach potentially exposed confidential business information, intellectual property, and user identities, underscoring the heightened risks posed by seemingly innocuous browser add-ons in enterprise environments. The incident marks a broader uptick in malicious and even some legitimate browser extensions turning to 'prompt poaching'—stealing user interactions with AI and chatbots. As AI adoption accelerates, organizations face new data exposure risks, demanding updated monitoring, awareness, and policy enforcement around browser extensions.
6 months ago
Kill Chain
Ransomware 2026: Inside the Surge of DDoS, Insiders, and Gig Worker Threats
In early 2026, ransomware groups rapidly adapted their extortion playbooks following a revenue decline, marked by a 47% year-over-year surge in attacks but falling ransom payments. Threat actors broadened tactics—reviving DDoS-for-hire within the Ransomware-as-a-Service (RaaS) model, ramping up recruitment of insiders (including targeting trusted employees and gig workers), and executing data theft via both technical and social attack vectors. Notably, attackers expanded beyond traditional Russian operators, evidencing global proliferation. These methods bypassed conventional defenses, with incidents tracked across multiple sectors and frequently resulting in significant data breaches, operational disruption, and reputational harm. The evolution of ransomware in 2026 highlights a rising urgency for enterprises to harden insider defenses, revisit DDoS mitigation, and validate physical security and third-party access. With attackers exploiting workforce instability, gig economy platforms, and hybrid extortion, a modernized, multi-layered security posture is now critical across all industries.
6 months ago
Kill Chain
Insider Threat Reality: US Cyber Pros Caught as BlackCat Ransomware Affiliates
In 2023, two U.S.-based cybersecurity professionals—formerly employed by major security firms—pleaded guilty to acting as affiliates for the ALPHV/BlackCat ransomware group. The individuals leveraged their insider knowledge and technical expertise to facilitate the deployment of the ransomware, compromising sensitive systems in targeted organizations. By exploiting weaknesses in internal security protocols and bypassing detection mechanisms, they assisted in the encryption of files and extortion of affected businesses, resulting in operational disruptions and significant reputational damage across multiple sectors. This incident highlights an escalating threat posed by insiders with privileged knowledge and skills, who collaborate with sophisticated ransomware groups like BlackCat. The convergence of advanced ransomware-as-a-service operations and trusted industry insiders signals a dangerous shift, amplifying calls for more robust zero trust strategies, stricter network segmentation, and improved insider threat monitoring.
6 months ago
Kill Chain
Inside the ClickFix Campaign: How Hospitality Firms Were Hit with DCRat Remote Access Attacks
In early 2024, a sophisticated phishing campaign known as 'ClickFix' targeted organizations in the hospitality sector with convincing fake 'Blue Screen of Death' error messages. Attackers leveraged social engineering techniques combined with a legitimate Microsoft utility to trick victims into executing malicious payloads. Once engaged, the attack delivered the DCRat remote access trojan, granting cybercriminals ongoing access and control over affected systems. The campaign demonstrated how legitimate tools and realistic lures can bypass conventional defenses, resulting in compromised credentials, lateral network movement, and potential data exfiltration. This incident reflects a wider trend of threat actors increasingly turning to legitimate software and advanced social engineering to evade detection. Remote access trojans like DCRat continue to be used in targeted attacks, particularly against sectors with complex digital footprints and limited security controls, making it vital for organizations to adapt their threat detection capabilities.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports