✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Matrix Push C2 Phishing Exposes Fileless Browser Attacks in 2025
In November 2025, a sophisticated phishing campaign was uncovered utilizing a novel command-and-control (C2) platform called Matrix Push C2. The threat actors exploited browser push notifications, fake alerts, and fileless redirection to lure users across multiple operating systems into interacting with malicious links. Researchers observed that the campaign delivered phishing payloads without traditional downloads, thereby evading many endpoint defenses and expanding its cross-platform reach. Impacted organizations reported heightened risks of credential theft, business email compromise, and data exfiltration stemming from the hard-to-detect, browser-native behavior of Matrix Push C2. This incident highlights the escalating threat of fileless attacks and creative social engineering, particularly as businesses increasingly rely on browser-based workflows. The abuse of browser notifications as a phishing vector presents a growing challenge for security teams and underscores the importance of proactive browser and endpoint defenses.
6 months ago
Kill Chain
Salesforce Data Breached Again: ShinyHunters Exploit Third-Party Gainsight in 2024 Attack
In June 2024, several Salesforce customers experienced a significant data breach perpetrated by the ShinyHunters extortion group. Attackers exploited vulnerabilities in a third-party vendor, Gainsight, which had integrations with Salesforce platforms. By compromising Gainsight, ShinyHunters acquired credentials or access tokens, enabling them to exfiltrate sensitive Salesforce customer data from multiple organizations. The breach demonstrates the persistent risk of attacks originating from trusted third-party software supply chains, resulting in the exposure of business and customer information and raising concerns about the security posture of major SaaS ecosystems. This breach highlights a continued trend in which attackers bypass direct controls by targeting vendors in a SaaS environment, leveraging weak third-party access and inadequate segmentation. As businesses increase SaaS adoption and interconnectivity, these attacks demonstrate the urgent need for enhanced third-party risk management and more granular network and identity controls.
6 months ago
Kill Chain
ToddyCat APT: How a Persistent Attacker Breached Outlook and Microsoft 365 Email in 2024
Between mid-2024 and early 2025, the ToddyCat advanced persistent threat (APT) group executed a sophisticated campaign targeting organizations' internal infrastructures to covertly access business email. Initially leveraging a new PowerShell variant of their TomBerBil tool to extract credentials, cookies, and encryption keys from browsers via SMB on privileged hosts, the group also introduced additional tools—TCSectorCopy and XstReader—to capture locked Outlook OST files and exfiltrate their contents. When detection increased, ToddyCat shifted to harvesting OAuth 2.0 tokens for Microsoft 365 mail through memory dumping, enhancing their ability to bypass on-host monitoring and access cloud emails externally. This campaign resulted in extensive compromise of sensitive correspondence, credentials, and lateral movement across impacted domains. This incident underscores the rapidly evolving tactics of nation-state groups to overcome modern defenses, highlighting trends in cross-cloud compromise, credential harvesting, and exploitation of endpoint-to-cloud trust boundaries. ToddyCat's use of both system-level and identity-driven attacks mirrors the increasing prevalence of multifaceted cyber threat techniques.
6 months ago
Kill Chain
Grafana 2025: Critical Admin Spoofing Flaw Demands Immediate Response
In June 2025, Grafana Labs disclosed a critical security vulnerability (CVE-2025-41115) affecting its Enterprise platform, enabling attackers to register new users and assign them administrator privileges or escalate existing privileges through crafted requests. This flaw made it possible for unauthorized actors to gain full control over instances, potentially compromising sensitive data dashboards and associated integrations. Grafana responded by releasing urgent patches, issuing advisories, and recommending immediate action to all Enterprise customers to prevent exploitation in production environments. This incident is particularly notable given the increasing threat posed by privilege escalation vulnerabilities in widely deployed SaaS and cloud-native products. Enterprises leveraging Grafana or other observability platforms must remain vigilant as attackers increasingly target misconfigurations and logic flaws to bypass identity-based controls and gain elevated access.
6 months ago
Kill Chain
CrowdStrike Insider Breach: How Scattered Lapsus$ Exploited Trusted Access in 2024
In early 2024, cybersecurity firm CrowdStrike identified an insider threat after discovering that an employee had shared screenshots of internal systems with external threat actors. The images, which were later leaked on Telegram by the Scattered Lapsus$ Hunters group, exposed sensitive details about CrowdStrike’s infrastructure and internal processes. CrowdStrike swiftly conducted an internal investigation, isolated the breach, and collaborated with law enforcement to mitigate potential risks. The incident highlights the growing challenge organizations face in protecting against trusted insiders acting maliciously or under external influence. This breach is particularly relevant given the increasing frequency of insider-driven attacks and the adoption of social engineering by advanced threat groups to bypass traditional perimeter defenses. The incident underscores the need for organizations to enhance their monitoring of internal activities and emphasize zero trust models.
6 months ago
Kill Chain
Salesforce Supply Chain Breach Exposes SaaS OAuth Risks in 2025
In November 2025, Salesforce detected unauthorized activity involving Gainsight-published applications integrated via OAuth tokens with the Salesforce platform. The breach potentially enabled attackers to access sensitive customer data by compromising OAuth connections between select third-party Gainsight apps and Salesforce tenant environments. Upon discovery, Salesforce revoked all active access and refresh tokens for affected integrations, initiated incident response protocols, and notified impacted customers. The unauthorized access appears limited to data accessible via the compromised tokens, but the full scope is still under investigation. This incident is significant as it demonstrates the inherent risks of third-party SaaS integrations and OAuth-based supply chain connections. As organizations increasingly leverage cloud-based ecosystems, attackers are targeting indirect trust relationships, exposing data via the weakest link. Enterprises face mounting regulatory, contractual, and operational risks from such supply chain attacks.
6 months ago
Kill Chain
Major Grafana SCIM Security Flaw Exposes Enterprises to Privilege Escalation Attacks
In June 2025, Grafana disclosed a critical application vulnerability (CVE-2025-41115, CVSS 10.0) affecting its System for Cross-domain Identity Management (SCIM) component. Exploitable under certain configurations, this flaw allowed unauthenticated attackers to impersonate users and escalate privileges across affected Grafana instances. The issue stemmed from improper validation within the SCIM API, which enabled threat actors to provision accounts and assign administrative rights remotely. Grafana promptly released security patches and urged customers to update immediately as exploitation could lead to full compromise of monitoring infrastructure and sensitive business data. This incident underscores the ongoing threat of privilege escalation via identity management flaws, especially as identity-driven attacks and supply chain risks escalate. The rise in zero-day exploits targeting management interfaces highlights the urgent need for continuous application security assessments and rapid patch management.
6 months ago
Kill Chain
Critical Oracle Fusion Middleware Vulnerability (CVE-2025-61757) Actively Exploited
In November 2025, CISA added CVE-2025-61757—a critical authentication bypass in Oracle Fusion Middleware—to its Known Exploited Vulnerabilities (KEV) Catalog after confirmed evidence of active exploitation. The flaw permits remote, unauthenticated attackers to access critical functions in affected Oracle Fusion Middleware environments, enabling privilege escalation, lateral movement, and potential data exfiltration. The vulnerability represents a significant threat to both public and private organizations relying on Oracle’s middleware technologies, particularly within the federal enterprise, as attackers rapidly weaponize such exposures before widespread patching can occur. This incident highlights an ongoing trend of attackers swiftly exploiting newly published vulnerabilities, emphasizing the necessity for organizations to prioritize timely patching and robust vulnerability management. With regulatory mandates and threat actor innovation intersecting, the urgency to remediate critical middleware exposures has never been greater.
6 months ago
Kill Chain
Oracle Identity Manager 2025: CVE-2025-61757 Authentication Bypass Exposed
In September 2025, multiple attacks targeted Oracle Identity Manager (OIM) instances by exploiting a critical authentication bypass vulnerability (CVE-2025-61757). The flaw, discovered by Searchlight Cyber and addressed in Oracle's October 21, 2025 Critical Patch Update, allows threat actors to append ';.wadl' to a URL, accessing privileged functionality without authentication. Logs show attackers conducted scans and POST requests using a consistent user-agent from diverse IPs before an official patch was released, evidencing rapid exploit development and the risk of remote code execution. This incident highlights the increasing threat posed by trivial, mass-scannable web application flaws in identity platforms and the speed at which adversaries weaponize new zero-day vulnerabilities. Cybersecurity teams must prioritize rapid patching and detection of unusual authentication exemption patterns to reduce critical risk exposure.
6 months ago
Kill Chain
Phishing Attack Uses CSS Stuffing on Firebase to Evade Detection in 2024
In November 2024, a phishing campaign leveraged Google Firebase Storage to host a credential-harvesting site that appeared as a convincing login overlay targeting recipients of a personalized email link. The HTML file was intentionally bloated—containing only a small amount of functional code alongside hundreds of kilobytes of unused or benign-looking CSS, including modified Bootstrap styles. This technique, referred to as "CSS stuffing," was likely used to manipulate heuristic or ML-based security scanners by altering the statistical fingerprint of the malicious file. Although most security scanners employ size thresholds well above the file size, the approach reflects increasing sophistication in phishing obfuscation tactics. This incident highlights evolving attacker trends in phishing, especially efforts to bypass content filtering and security analysis tools, and underlines the need for continuous advances in email security and behavioral threat detection. Organizations must remain vigilant against obfuscated phishing threats that exploit widely trusted cloud services.
6 months ago
Kill Chain
Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat
In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk. This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.
6 months ago
Kill Chain
D-Link DIR-878 End-of-Life Routers Hit by Critical 2024 RCE Flaws
In June 2024, D-Link issued an urgent advisory regarding three critical remote command execution (RCE) vulnerabilities affecting all models and hardware revisions of its end-of-life DIR-878 wireless routers. These flaws, discovered by cybersecurity researchers, allow unauthenticated remote attackers to execute arbitrary commands on the device, effectively gaining full control. Although D-Link had ended firmware support in 2021, the routers remain in widespread use, especially in emerging markets, increasing the exposure of organizations and individuals who have not decommissioned the devices. The attackers can exploit these weaknesses for lateral movement, network reconnaissance, or as a foothold into larger networks. This incident underscores the dangers posed by unsupported legacy hardware and the importance of proactive lifecycle management. Given the vulnerabilities enable full device compromise with no user interaction, similar RCE attacks targeting end-of-life networking equipment are likely to rise as threat actors pivot toward unpatched infrastructure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports