✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Microsoft Mitigates Windows LNK Zero-Day Exploited in Active Attacks
In June 2024, Microsoft addressed a high-severity zero-day vulnerability (CVE-2024-38112) affecting Windows LNK files. Multiple state-sponsored and cybercriminal groups exploited this flaw in-the-wild, leveraging maliciously crafted shortcut files to execute arbitrary code with user privileges. Attackers gained initial access by delivering LNK payloads via phishing emails and drive-by downloads, bypassing standard user awareness and endpoint defenses. Successful exploitation enabled threat actors to deploy malware, pivot laterally, exfiltrate sensitive data, and disrupt business operations before Microsoft’s silent mitigation, which came ahead of a formal patch release. The incident highlights increasing trends in the exploitation of novel and low-friction attack vectors, such as Windows shortcuts, which evade traditional detection. With LNK abuse on the rise among advanced persistent threats (APTs) and financially motivated actors, organizations face mounting pressure to close gaps in endpoint security, monitoring, and privilege management.
6 months ago
Kill Chain
Freedom Mobile Data Breach 2024: Customer Information Compromised via Account Platform
In June 2024, Freedom Mobile, Canada's fourth-largest wireless carrier, publicly disclosed a significant data breach after attackers compromised its customer account management platform. Unauthorized access allowed threat actors to steal sensitive customer data, including personal information such as names, contact details, and possibly financial information. The breach's scope is still being assessed, but the incident highlighted vulnerabilities in the exposed platform, prompting a swift operational and security review. Immediate remedial measures included engaging external cybersecurity experts, notifying impacted customers, and alerting regulatory authorities as required by Canadian privacy law. This incident underscores the continued risk posed by attacks targeting customer portals and account management systems—an increasingly common vector across the telecom sector. With regulatory scrutiny around privacy and data protection intensifying globally, this breach offers a stark reminder of the critical importance of securing customer data and internal administrative interfaces.
6 months ago
Kill Chain
Shai Hulud 2.0: The npm Supply Chain Worm Disrupting DevOps
In September 2023, a sophisticated supply-chain attack dubbed Shai Hulud 2.0 targeted the JavaScript ecosystem by compromising over 800 Node Package Manager (npm) packages. The malware leveraged stolen npm tokens to spread and infect trusted packages with a worm-like, two-stage payload. Upon download, it harvested GitHub and cloud credentials, aggressively scanned files for secrets, and exfiltrated stolen data via malicious public GitHub repositories. If unable to gain access tokens for exfiltration, the malware triggered a destructive file-wiping payload, disrupting both individual developers and organizations. Widespread impact was observed across Russia, India, Brazil, Vietnam, and more. This incident underscores the escalating risk of deep supply-chain compromise through open-source ecosystems and highlights attackers' evolving Tactics, Techniques, and Procedures (TTPs). It demonstrates the urgent need for enhanced monitoring, credential protection, and robust controls within software supply chains.
6 months ago
Kill Chain
Critical Picklescan Bugs Expose PyTorch Supply Chain: Malicious Models Bypass Security
In December 2025, severe vulnerabilities were revealed in Picklescan, an open-source security tool designed to scan Python pickle files for malicious code, particularly those used with PyTorch models. Attackers were able to exploit three critical flaws, bypassing Picklescan’s intended protections to execute arbitrary code during model loading processes. This effectively enabled the distribution of malicious machine learning models that could compromise developer and production environments. The risk was amplified due to Picklescan’s popularity in data science and AI workflows, potentially impacting organizations across multiple sectors relying on PyTorch. The incident is a stark reminder of the growing risk posed by supply-chain vulnerabilities in open-source AI and machine learning tooling, especially as the adoption of MLOps and automated model deployment platforms accelerates. Organizations now face increased regulatory scrutiny and operational risks tied to software supply chain security in the era of AI-driven applications.
6 months ago
Kill Chain
Exploited in the Wild: Microsoft’s Windows LNK Flaw Finally Patched After Years of Attacks
In November 2025, Microsoft silently patched CVE-2025-9491, a Windows Shortcut (LNK) file vulnerability, after years of active exploitation dating back to 2017. This flaw allowed threat actors to leverage malicious LNK files for privilege escalation and potential remote code execution through user interface misinterpretation. Attackers routinely embedded harmful LNKs in phishing emails or compromised archives, enabling them to bypass security controls and gain unauthorized access to targeted Windows systems. The issue was resolved only after mounting pressure from researchers and documented abuse by multiple attacker groups. This incident is notable as it underscores persistent risks from longstanding Windows flaws exploited in the wild. The continued abuse of LNK vulnerabilities highlights the importance for organizations to prioritize patching and segment internal networks to limit the blast radius of privilege escalation attacks.
6 months ago
Kill Chain
Critical React Server Components Flaw Enables RCE in 2025—What You Need to Know
In December 2025, a maximum-severity vulnerability (CVE-2025-55182), codenamed React2shell, was uncovered in React Server Components (RSC), impacting platforms like React and Next.js. The flaw enables unauthenticated remote code execution (RCE) by exploiting how React decodes certain payloads sent to its server components. If left unpatched, attackers can execute arbitrary code on vulnerable servers, leading to full system compromise and severe business disruption. The incident highlights the critical impact of supply chain vulnerabilities in widely-used open-source frameworks and the elevated risk for businesses relying on modern web development stacks. The discovery of React2shell has triggered urgent patch advisories, as similar RCE vulnerabilities in web frameworks have seen rapid weaponization by threat actors. With increasing regulatory expectations for timely patch management and growing attacker focus on open-source component supply chains, this incident reinforces the need for continuous application security monitoring and robust SDLC controls.
6 months ago
Kill Chain
Raptor Framework: AI-Powered Exploit and Patch Creation Disrupts Vulnerability Management
In June 2024, security researchers publicly released the Raptor Framework, an open source AI-powered toolkit capable of autonomously generating both exploit code for software vulnerabilities and their corresponding security patches. Leveraging large language models (LLMs) and novel prompting techniques, the framework orchestrates agentic AI workflows to iterate, test, and refine functional exploit and remediation code at scale. While initially intended for defensive and research use, the dual-use nature of Raptor means malicious actors could similarly employ it to accelerate exploit development or enable broader, automated vulnerability discovery across cloud and on-prem environments. The release of the Raptor Framework highlights urgent concerns around weaponized AI and the rapid democratization of advanced cyber capabilities. Security leaders must act now, as similar agentic LLM tools could fuel faster attack cycles, strain patching processes, and escalate regulatory scrutiny around software security and responsible AI use.
6 months ago
Kill Chain
Salt Typhoon: Chinese APT Breaches U.S. Telecom Networks via Basic Vulnerabilities
In 2023, the Chinese state-sponsored threat group known as Salt Typhoon (a Microsoft designation) successfully compromised at least nine major U.S. telecommunications providers. Exploiting longstanding weaknesses—including unpatched vulnerabilities, weak passwords, and lack of multifactor authentication—attackers gained persistent network access and targeted high-level U.S. politicians, emergency service entities, and critical infrastructure. The intrusions, described by U.S. officials as unprecedented in scale, were undetected for a prolonged period and raised alarms about the broader security and resilience of telecom networks. This incident exemplifies the growing sophistication and persistence of nation-state cyber threats, especially against critical infrastructure sectors. It has spurred debate on regulation versus voluntary information sharing, highlighting urgent gaps in basic cyber hygiene and the systemic risk posed by failing to address widely known vulnerabilities.
6 months ago
Kill Chain
University of Pennsylvania Data Breach Highlights ERP Security Risks in Higher Ed
In August 2024, the University of Pennsylvania confirmed that attackers infiltrated its Oracle E-Business Suite (EBS) systems, resulting in the theft of documents containing sensitive personal information. The breach, which was disclosed after internal investigations, leveraged vulnerabilities in Oracle EBS servers, a critical system for managing finances, supply chains, and human resources, enabling threat actors to compromise and exfiltrate sensitive employee and institutional data. Although the University has taken remediation steps and notified those affected, the attack underscores ongoing risks within higher education due to reliance on complex, legacy ERP platforms and the attractiveness of academic institutions as targets. This incident comes amidst a broader surge in attacks exploiting unpatched ERP systems, highlighting persistent gaps in internal segmentation and the monitoring of east-west traffic. As higher education faces increased regulatory and ransomware pressures, this breach serves as a warning of the urgent need for robust visibility, policy enforcement, and modernized security postures.
6 months ago
Kill Chain
Google 2025 Android Zero-Day Attacks: Lessons on Mobile Vulnerability Exploitation
In December 2025, Google disclosed that it had patched 107 Android vulnerabilities, including two zero-day flaws exploited in active attacks. These zero-days, tracked as CVE-2025-23027 (privilege escalation in the System component) and CVE-2025-23028 (in the Kernel), were weaponized by threat actors to target select Android devices, likely via malicious apps or tailored exploits. Google's rapid response involved issuing security updates through its December Android Security Bulletin, minimizing the attack surface and urging device manufacturers and users to deploy patches immediately. The incident highlights the ongoing challenges of mobile platform security and the rapid exploitation of unknown flaws by attackers. This event is emblematic of the rise in advanced mobile vulnerability exploitation, where threat actors seek to bypass native OS security and target sensitive mobile endpoints. With the prevalence of bring-your-own-device (BYOD) policies and increasing mobile workforce reliance, timely patching and comprehensive visibility are more crucial than ever to defending against agile, targeted attackers.
6 months ago
Kill Chain
Cybercrime Goes SaaS: The Rise of Crime-as-a-Service in 2024
In early 2024, cybersecurity researchers observed a surge in Crime-as-a-Service (CaaS) operations leveraging a subscription-based model. Attackers now rent access to advanced phishing kits, infostealer logs, Remote Access Trojans (RATs), and one-time password bots on popular chat platforms like Telegram, dramatically lowering the barrier to entry for cybercrime. These CaaS platforms enable even low-skilled actors to execute sophisticated intrusion campaigns targeting organizations across industries, often resulting in credential theft, ransomware outbreaks, and large-scale data breaches. This operational shift has enabled attackers to strike at scale and adapt quickly to new defenses, amplifying business risks and potential regulatory violations. The rise of CaaS signifies a pivotal threat evolution: democratized, on-demand cybercrime. Organizations must now address not just known threat actors, but a growing pool of opportunists leveraging plug-and-play hacking tools. This trend is accelerating, leading to urgent pressures for improved identity controls, network segmentation, and rapid anomaly detection.
6 months ago
Kill Chain
Shai-Hulud 2.0: 2024 NPM Supply Chain Attack Exposes 400,000 Developer Secrets
In June 2024, the 'Shai-Hulud 2.0' campaign executed a large-scale supply chain attack against the JavaScript ecosystem by compromising over 750 packages on the NPM registry. Attackers used malicious dependencies to covertly exfiltrate environment variables and developer secrets to public GitHub repositories, exposing as many as 400,000 authentication credentials and tokens. The attack leveraged automation to rapidly disseminate malware and gather sensitive data from unwitting developers and CI systems, impacting thousands of organizations and potentially enabling downstream breaches. This incident underlines the growing risks of open-source supply chain vulnerabilities and highlights attacker innovation in automated credential harvesting. With supply chain attacks rising and developers relying on public package repositories, proactive controls and zero-trust practices have never been more essential to prevent code-integrity and data-exposure risks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports