✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
QNAP Backup Software Exposed by Critical ASP.NET Vulnerability in 2024
In June 2024, QNAP, a prominent provider of network-attached storage (NAS) solutions, disclosed that its NetBak PC Agent backup utility for Windows is vulnerable to a critical ASP.NET Core flaw (CVE-2024-27348). This vulnerability, originally reported in Microsoft's platform, allows unauthenticated remote attackers to potentially execute arbitrary code or compromise data in transit. QNAP urged customers to apply security patches immediately, as exploitation may permit attackers to pivot from compromised endpoints to valuable NAS devices, affecting both business continuity and data confidentiality. The QNAP incident highlights the ongoing risk of supply-chain vulnerabilities, particularly when third-party software libraries are widely adopted. With attackers increasingly leveraging zero-day software flaws and targeting backup systems as initial entry points for ransomware and data exfiltration, IT teams must remain vigilant about patching integrations and dependencies across the entire software stack.
6 months ago
Kill Chain
Google Refutes False Gmail Breach Claims: 2024’s Disinformation Lessons
In June 2024, widespread news reports falsely claimed that Google suffered a massive Gmail data breach affecting 183 million accounts. These reports, originating from threat actors attempting to sell alleged stolen data, quickly circulated across media outlets and online forums. Google promptly denied these claims, confirming after internal and external investigations that no breach had occurred and user data remained secure. The incident stemmed from recycled or previously disclosed information being misrepresented as new, leading to confusion and unwarranted concern among users and industry observers. This incident underscores the growing prevalence of cybersecurity disinformation campaigns aiming to erode trust in major service providers. Such false claims can create unnecessary panic, damage reputations, and distract from real threats, emphasizing the urgent need for robust threat validation and information hygiene in the modern digital landscape.
6 months ago
Kill Chain
LockBit 5.0 Resurgence: How WSUS and F5 Vulnerabilities Fueled 2025's Biggest Ransomware Wave
In October 2025, a coordinated wave of cyberattacks struck major enterprise environments worldwide. Attackers exploited Windows Server Update Services (WSUS) flaws and vulnerabilities in F5 infrastructure, deploying the new LockBit 5.0 ransomware variant. Using phishing, unauthorized RDP access, and advanced persistence techniques, LockBit affiliates moved laterally across networks, encrypting critical data and disrupting cloud-hosted workloads. Compromised systems experienced operational downtime, data theft, and subsequent ransom demands, while threat actor activity on underground forums confirmed an aggressive resurgence and evolving TTPs. This incident underscores the heightened pace and sophistication of ransomware operations, with threat actors exploiting both zero-day vulnerabilities and supply chain channels. As enterprise defenses adapt to increasingly hybrid and distributed infrastructure, recent attacks have spotlighted urgent needs for segmentation, real-time visibility, and policy enforcement to counter proactive adversary tactics.
6 months ago
Kill Chain
ChatGPT Atlas Browser Hack Reveals Persistent AI Command Exploit
In October 2025, cybersecurity researchers revealed a critical vulnerability in OpenAI’s ChatGPT Atlas web browser, enabling attackers to plant persistent hidden commands within the AI assistant’s memory. Exploiting weaknesses in browser-based AI integration, adversaries were able to inject malicious code that allowed system compromise, privilege escalation, and malware deployment. This attack vector bypassed traditional security controls, proving effective in environments that heavily relied on browser AI plugins for business workflows. The exploit was notable for its ease of delivery through crafted websites or malicious scripts and posed significant operational and reputational risks to affected organizations. This incident underscores the urgent need for robust AI security governance as businesses rapidly integrate AI-powered tools into daily operations. The exploit spotlights a growing class of AI/ML-driven attacks leveraging browser interfaces, echoing wider industry concerns on shadow AI risks and prompting fresh regulatory scrutiny.
6 months ago
Kill Chain
Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses
In early to mid-2025, the notorious Qilin ransomware group (also known as Agenda/Gold Feather/Water Galura) executed a wave of aggressive hybrid cyberattacks, combining Linux-targeting ransomware payloads with a sophisticated BYOVD (Bring Your Own Vulnerable Driver) exploit. The attacks leveraged unpatched vulnerabilities to gain initial access, followed by lateral movement across multi-cloud and on-premises environments. Once inside, Qilin deployed encryption routines across both Windows and Linux servers, exfiltrated sensitive business data, and posted victim details on its dark web leak site, with attack volumes peaking at over 100 cases in June 2025. Organizations across healthcare, finance, and manufacturing were among those affected, experiencing significant operational disruptions, data exposure risks, and costly recovery processes. The rise of cross-platform ransomware with BYOVD techniques demonstrates attackers' growing technical sophistication and ability to evade traditional defenses. As ransomware-as-a-service (RaaS) operations like Qilin accelerate, organizations face increasing regulatory scrutiny and must enhance cloud, endpoint, and network segmentation strategies to defend against such adaptive threats.
6 months ago
Kill Chain
Qilin Ransomware Breach: Linux-Based Attack Targets Windows Hosts in 2024
In early 2024, the Qilin ransomware-as-a-service (RaaS) group executed a sophisticated attack leveraging a Linux-based payload to compromise Windows hosts. This cross-platform ransomware evaded many traditional security solutions, enabling the threat actors to gain access through targeted phishing and lateral movement techniques. The attackers rapidly encrypted critical data, demanding ransom payments, and causing business disruption across affected organizations. Qilin's attack uniquely circumvented endpoint protection measures designed for a single operating system, highlighting a significant challenge for heterogeneous IT environments. This incident underscores a rising trend of cross-platform ransomware operations, where attackers tailor malware to exploit gaps in multi-OS networks. Security teams are urged to reassess their detection capabilities in light of these evolving threat vectors and intensifying RaaS activity.
6 months ago
Kill Chain
How Attackers Are Abusing DNS for Covert Command and Control in 2024
In October 2024, security researchers highlighted a critical technique enabling Command and Control (C2) communication over DNS channels by encoding arbitrary byte values in DNS queries—even when traversing third-party infrastructures like Cloudflare and Google. Using custom-crafted DNS packets, attackers can bypass traffic inspection and filtering, exploiting DNS to exfiltrate or transfer data using modified BASE64 or expanded ASCII, which can evade many traditional network defenses due to protocol limitations and inconsistent validations among DNS providers. This creates a covert path for malware to communicate without detection by standard security tools. This incident underscores a rising trend where attackers leverage ubiquitous protocols—such as DNS—for covert C2, presenting profound challenges for organizations seeking to secure east-west traffic and detect advanced threats. Awareness is crucial, as advanced C2 techniques are increasingly observed in malware campaigns exploiting gaps in DNS monitoring and anomaly detection.
6 months ago
Kill Chain
CoPhish 2024: How Microsoft Copilot Studio Became a Vector for OAuth Phishing
In early June 2024, security researchers discovered a sophisticated phishing campaign dubbed 'CoPhish' exploiting Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests. By leveraging legitimate Microsoft domains and trusted Copilot workflows, attackers deceived enterprise users into granting malicious apps access to their Microsoft 365 accounts, thereby stealing OAuth tokens and enabling unauthorized access to sensitive emails, files, and collaborative workspaces. The attack chain bypassed traditional email security controls due to its reliance on trusted infrastructure and social engineering, putting multiple organizations at risk of data compromise and account takeover. This incident underscores the growing trend of threat actors abusing trusted cloud and AI-powered collaboration platforms, capitalizing on user trust and shadow IT. It highlights urgent security concerns around identity-driven attacks, modern authentication abuse, and the need for enhanced vigilance in managing third-party OAuth authorizations.
6 months ago
Kill Chain
Synthient Data Breach 2024: 2 Billion Exposed Credentials Spark Global Risk
In early 2024, a new breach known as the 'Synthient Threat Data Collection' surfaced, encompassing a staggering two billion unique email addresses tied to credential stuffing operations. This data was amassed from large-scale compromise campaigns and open sources, then processed and analyzed for integrity and novelty on high-capacity infrastructure. The breach reflects the increasing industrialization of credential harvesting by attackers, raising significant privacy and security concerns for individuals and organizations across sectors, as many of these records had never before been reported in regular breach repositories. The exposure demonstrates a dramatic uptick in both credential reuse attacks and the volume of personal data accessible to cybercriminals. As data brokers and threat actors accelerate their harvesting and aggregation campaigns, organizations must bolster detection, consumer alerts, and incident response to meet new regulatory and operational risks.
6 months ago
Kill Chain
Microsoft Issues Emergency Patch for Critical WSUS Vulnerability (CVE-2025-59287)
In October 2025, Microsoft disclosed and initially patched a critical vulnerability, tracked as CVE-2025-59287, in its Windows Server Update Services (WSUS) platform. The flaw, actively exploited in the wild, allowed attackers to compromise the WSUS update mechanism, potentially enabling malicious code injection during trusted Windows Server updates. Rapid exploitation following the Patch Tuesday release prompted Microsoft to issue an emergency out-of-band security update in response to ongoing attacks, underscoring the vulnerability's urgency and the risk of widespread operational impact for enterprises reliant on WSUS. This incident highlights the escalating frequency of supply chain and update-platform attacks as adversaries increasingly target patch distribution mechanisms. The rise in vulnerability exploitation, particularly against trusted infrastructure components, is driving regulatory attention and motivating organizations to reassess their zero trust models and patch management processes.
6 months ago
Kill Chain
Threat Actors Exploit AzureHound for Cloud Reconnaissance in 2024
In early 2024, threat actors were observed misusing AzureHound, a powerful cloud pentesting and reconnaissance tool, to discover and map sensitive resources within Microsoft Azure environments. Instead of supporting authorized security assessments, malicious groups leveraged AzureHound's automation to enumerate identities, permissions, and relationships with the intent to facilitate lateral movement and privilege escalation. The attackers accessed cloud APIs with stolen or compromised credentials, largely evading detection until telemetry patterns indicative of broad cloud discovery were identified by Unit 42 researchers. The incident highlighted the urgent need for robust monitoring and threat detection tailored for cloud-specific attack vectors. This incident underscores an accelerating trend in the weaponization of legitimate security tools by adversaries to attack cloud infrastructure. As organizations rapidly adopt multi-cloud strategies, the risk surface expands, magnifying the necessity for proactive defense strategies and comprehensive visibility into cloud-based TTPs.
6 months ago
Kill Chain
Pwn2Own Ireland 2025: Researchers Unveil 73 Zero-Day Vulnerabilities
In June 2025, the Pwn2Own Ireland hacking competition saw security researchers successfully exploit 73 unique zero-day vulnerabilities across a variety of enterprise software and devices. Over $1,024,750 in rewards were awarded as teams identified and demonstrated live, working exploits, many targeting critical business platforms. These zero-days, by definition previously unknown to vendors, highlight the rapid pace at which vulnerabilities are discovered and the ongoing challenges organizations face in maintaining strong security posture against both sophisticated and opportunistic attackers. This event underscores the persistent risk of zero-day vulnerabilities and the growing sophistication of offensive security research. The scale and speed of exploit identification at Pwn2Own reflect broader industry trends, including increased investment in bug bounties and rising regulatory expectations for vulnerability management and disclosure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports