✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Ubia Ubox IoT Cameras Exposed: 2025 Credential Vulnerability Risks
In November 2025, a critical vulnerability (CVE-2025-12636) was disclosed in Ubia's Ubox smart camera platform, affecting version 1.1.124. The issue—insufficiently protected credentials—enables a remote attacker with low complexity to exploit API credential weaknesses, providing unauthorized access to live camera feeds and the ability to modify device settings. No public exploitation has yet been reported, but the vulnerability impacts commercial facilities worldwide, especially enterprises deploying these IoT cameras without network segmentation or backend isolation. Ubia did not engage with CISA coordination efforts. This incident exemplifies the ongoing risks associated with insecure IoT/ICS deployments and the lack of vendor responsiveness. With increased regulatory scrutiny and attacker interest in operational technology, ensuring proper credential management and network segmentation is an urgent priority for organizations using connected surveillance systems.
6 months ago
Kill Chain
Multiple ChatGPT Security Bugs Expose User Data in 2023 OpenAI Breach
In March 2023, OpenAI faced a significant application security incident involving multiple vulnerabilities within its flagship ChatGPT platform. Attackers exploited bugs that enabled prompt injection, retrieval of other users’ conversation histories, and potential bypassing of safety restrictions, exposing sensitive user data and proprietary prompts. These exploits, which allowed lateral movement and unauthorized data exfiltration, highlighted systemic issues in handling session tokens, API security, and isolation of user environments. The breaches forced OpenAI to temporarily take ChatGPT offline, conduct emergency patching, notify users, and engage external security review. The operational impact included reputational damage and increased regulatory scrutiny over cloud-based AI platforms’ data handling. This event underscores the growing risk as generative AI platforms become integral to business operations and personal productivity. The use of increasingly complex APIs and reliance on cloud-native architecture have introduced new attack surfaces, making timely detection and robust segmentation critical. Regulatory bodies and security practitioners now regard application-layer lateral movement and API leakage as top-tier threats, especially given AI’s centrality to enterprise workflows.
6 months ago
Kill Chain
WhatsApp’s Screen-Sharing Feature: The 2024 Social Engineering Scam You Didn’t See Coming
In early 2024, a growing wave of cyber scams exploited WhatsApp’s new screen-sharing feature. Threat actors, posing as trusted contacts or customer support agents, lured victims into screen-sharing sessions under false pretenses—most often by claiming to offer help or resolve issues. Once shared, attackers gained access to sensitive information displayed on victims’ devices, including banking credentials and one-time passwords (OTPs), resulting in significant financial losses and compromised personal data. The scam’s speed and sophistication allowed fraudsters to bypass traditional awareness training and exploit even tech-savvy users. This incident highlights how social engineering threats adapt quickly to new app features, and underscores the need for rapid security responses. With mobile devices playing a pivotal role in personal and financial life, the exploitation of trusted communication platforms marks a critical evolution in phishing and remote fraud tactics.
6 months ago
Kill Chain
Google's 2024 Warning: AI-Powered Malware Leveraging LLMs in the Wild
In early 2024, Google's Threat Intelligence Group (GTIG) detected a rise in cyberattacks involving new malware families leveraging artificial intelligence, particularly large language models (LLMs), to enhance evasiveness, automate code generation, and increase payload adaptability in real time. Attackers orchestrated campaigns using AI-enhanced malware to breach enterprise environments through sophisticated spear-phishing, malicious attachments, and exploited vulnerabilities, successfully bypassing traditional detection methods. Some campaigns were linked to known advanced persistent threat (APT) groups, causing disruptions to business operations, data confidentiality, and elevating the risk profile for organizations across various sectors. This incident underscores a pivotal shift in the cyber threat landscape toward swift, adaptive attacks driven by AI capabilities. The integration of LLMs into malware enables more dynamic compromise techniques, signaling urgent need for advanced threat detection and revised security controls across industries.
6 months ago
Kill Chain
University of Pennsylvania 2024 Data Breach: Alumni and Donor Information Compromised
In June 2024, the University of Pennsylvania confirmed a data breach involving unauthorized access to several internal systems linked to its development and alumni activities. Attackers infiltrated the university’s IT infrastructure, resulting in the theft of sensitive personal and institutional data. The breach impacted donors, alumni, and staff, exposing information such as names, contact details, and potentially financial data. University officials discovered the intrusion after observing suspicious activity and promptly initiated an investigation. Law enforcement and cybersecurity specialists were engaged to contain the incident, assess affected systems, and notify those impacted. This breach highlights the persistent risks that higher education institutions face from increasingly sophisticated cyberattacks, especially targeting sensitive donor and alumni databases. As ransomware and data exfiltration trends intensify, universities must enhance defenses and closely align with compliance frameworks to mitigate regulatory, reputational, and operational risks.
6 months ago
Kill Chain
State-Sponsored Attackers Breach SonicWall Firewall Backups in 2023
In September 2023, SonicWall disclosed a security breach where state-sponsored threat actors gained unauthorized access to systems containing customer firewall configuration backup files. The incident was investigated thoroughly, and SonicWall determined that sophisticated attackers exploited vulnerabilities, allowing access to backup files with potentially sensitive customer information. The breach did not involve ransomware or financial extortion but had the potential to expose operational details and configurations of deployed firewalls, raising concerns over further lateral movement or exploitation. Attacks like these underscore the growing threat posed by well-resourced, nation-state actors directly targeting technology vendors and supply chain components. As attackers prioritize exploiting configuration data, the security of infrastructure suppliers is under renewed scrutiny and regulatory interest, emphasizing the need for robust data encryption, segmentation, and incident response.
6 months ago
Kill Chain
Gootloader Malware Loader Strikes Back: 2024 SEO Poisoning Campaign Unveiled
In early June 2024, cybersecurity researchers reported the resurgence of the Gootloader malware loader after a seven-month hiatus. The campaign utilizes SEO poisoning tactics to drive unsuspecting users to fraudulent websites that appear in popular search engine results. Once on these sites, victims are tricked into downloading malicious files, which Gootloader then leverages to install additional malware payloads such as ransomware or information stealers. This renewed activity demonstrates a continued evolution of the Gootloader group’s techniques, making detection and prevention difficult for organizations. The impact spans both enterprise and individual users, increasing risks of data theft, ransomware infections, and business disruptions. This campaign’s return highlights an alarming trend: threat actors are rapidly enhancing their distribution channels using social engineering and search engine manipulation. As cybercriminals adapt faster than many organizations secure their environments, it is urgent to reassess security controls, training, and detection reliability against loader-based threats.
6 months ago
Kill Chain
CentOS Web Panel Suffers Wide Scale Attacks Via Remote Command Execution Flaw
In early 2024, a critical remote command execution (RCE) vulnerability in CentOS Web Panel (CWP) was actively exploited by threat actors, as publicly warned by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Attackers leveraged this flaw, tracked as CVE-2022-44877, to gain unauthorized access to servers running CWP, enabling them to execute arbitrary commands and potentially take full control of affected systems. This exploitation campaign targeted internet-facing CWP instances, presenting significant risks to organizations relying on the popular Linux-based server management tool. The fallout included possible data compromise, deployment of additional malware, and interruption of web services. This incident highlights a growing trend in mass exploitation of critical web application vulnerabilities, with attackers increasingly focusing on widely-adopted open-source platforms. High-profile government advisories and the prevalence of ransomware toolkits leveraging RCE flaws have driven organizations to reinforce patch management and incident response as regulatory and operational priorities.
6 months ago
Kill Chain
CISA Adds Gladinet and CWP Flaws to KEV After Confirmed Exploitation
In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added critical vulnerabilities impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Attackers have leveraged CVE-2025-11371 and similar flaws, which expose sensitive files or directories, enabling unauthorized code execution and unauthorized access to critical business data. Exploitation techniques include remote access and privilege escalation, with incidents observed in both enterprise and cloud environments. The exploited weaknesses have led to compromised systems and elevated business risk for affected organizations. This incident highlights an escalating trend in the exploitation of web-facing management panels and software supply chain components, making east-west traffic security and timely vulnerability management crucial for defenders. Regulatory and industry pressure is mounting as the pace and sophistication of attacks accelerate.
6 months ago
Kill Chain
ChatGPT 2025 Vulnerabilities: How AI Memory Leaks Put Data at Risk
In November 2025, cybersecurity researchers uncovered and disclosed a set of seven critical vulnerabilities affecting OpenAI's ChatGPT, specifically the GPT-4o and GPT-5 models. The vulnerabilities allowed attackers to exploit memory and chat history mechanisms, enabling the unauthorized extraction of sensitive user information—including personal data and confidential conversation content—without user awareness. The flaws could be triggered remotely through crafted prompts and API calls, presenting a considerable risk both to individuals and enterprises leveraging ChatGPT in production environments. OpenAI has issued patches and advisories, but the revelations highlight the rapid evolution and complexity of securing AI models at scale. This incident is especially significant given the increasing reliance on generative AI in business workflows and the concurrent surge in attacks targeting AI-powered infrastructure. With regulatory scrutiny intensifying around AI data handling and the advent of new compliance frameworks, protecting AI systems against data leakage has become a board-level imperative.
6 months ago
Kill Chain
Pro-Russian APT Uses Linux VMs to Evade Windows Security in 2024
In early 2024, the pro-Russian threat group known as Curly Comrades leveraged Linux virtual machines within Windows environments to bypass security controls and evade detection. By deploying Linux VMs on compromised Windows hosts, the attackers concealed their activities, used native tools for lateral movement, and exfiltrated sensitive data without triggering traditional endpoint or network monitoring. This novel cross-OS technique allowed extended dwell time and left organizations vulnerable to espionage, data loss, and operational disruption. This incident is especially relevant given the continuing evolution of threat actor tactics, including living-off-the-land and virtualization abuse. Organizations must adapt defenses to anticipate adversaries' creative use of multi-platform infrastructures and strengthen their east-west visibility to prevent stealthy attacks.
6 months ago
Kill Chain
Proliance Surgeons Breach: Ransomware Exposes Hidden Supply Chain Risks
In January 2024, Proliance Surgeons, a major US healthcare provider, suffered a significant data breach after ransomware group Midas targeted its third-party vendor, PJ&A, which provides medical transcription services. The attackers exploited insufficient east-west traffic segmentation and leveraged VPN credentials to move laterally through Proliance’s environment, encrypting data and exfiltrating files containing patient names, addresses, dates of birth, medical record numbers, and clinical details. Business operations were disrupted for days, and regulatory investigations are underway, posing severe operational and reputational risks for both Proliance and its downstream partners. This breach underscores the ongoing vulnerability of healthcare organizations to supply chain ransomware attacks. With ransomware groups shifting tactics to exploit third-party vendors and focusing on lateral movement for maximum damage, healthcare organizations must modernize network segmentation, enhance detection capabilities, and achieve compliance with stricter data protection mandates.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports