✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
F5 Vulnerability Exposes Visibility Gaps in DHS’s CDM Program
In June 2024, a critical vulnerability affecting F5 devices exposed a major blind spot within the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program, which is tasked with overseeing federal cybersecurity assets. The Cybersecurity and Infrastructure Security Agency (CISA) was forced to issue an emergency directive after learning that a nation-state actor had exploited F5 edge devices to gain persistent access across multiple civilian federal agencies. The directive revealed that while thousands of F5 systems were in use, there was significant uncertainty about their location due to gaps in federal asset inventory capabilities, particularly for internet-facing edge devices like F5 BIG-IP load balancers. As a result, agencies had to scramble to manually identify and secure affected systems, highlighting the operational impact of incomplete visibility and asset management. The incident underscores the growing risks associated with network edge devices, which have become prime targets for sophisticated attackers exploiting gaps outside traditional IT inventories. As cloud adoption and edge architectures proliferate, ensuring asset visibility and securing non-traditional endpoints have become urgent priorities for government and private sector organizations alike, as attackers increasingly exploit these visibility gaps.
6 months ago
Kill Chain
Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge
In 2024, security researchers tracked a surge in activity from a sophisticated smishing (SMS phishing) group known as Smishing Triad, a decentralized operation managed in Chinese, leveraging a network of over 195,000 malicious domains to steal sensitive information globally. Domains impersonated critical sectors—including U.S. postal services, financial firms, healthcare, e-commerce, and government agencies—with the majority hosted in the U.S., China, and Singapore. Cross-functional threat actors orchestrated attacks via mobile messaging and Telegram forums, evolving tactics to avoid detection; most domains were short-lived, amplifying evasion and operational scale. This incident stands out for its scale, rapid infrastructure cycling, and global targeting, highlighting rising threats from organized smishing groups. The continued proliferation of phishing-as-a-service operations, increasing attacker collaboration, and adoption of short-lived domain infrastructures demonstrate the urgent need for improved east-west security controls, rapid detection, and stronger identity-based segmentation.
6 months ago
Kill Chain
FinWise Data Breach 2024: When Encryption Is the Last Line of Defense
In early 2024, FinWise, a financial services provider, suffered a significant data breach traced to an insider threat that circumvented internal security controls. The attacker exploited inadequate encryption of sensitive data in transit, extracting customer records via lateral movement across poorly segmented network segments. Because traffic was not properly encrypted, packet sniffing allowed the attacker to collect financial and personal data largely undetected for several weeks. The breach led to loss of confidential information, potential regulatory scrutiny, and reputational harm for FinWise. This incident highlights a rising wave of insider threats exploiting deficiencies in east-west traffic security and underscores the importance of robust, end-to-end encryption as regulatory bodies tighten requirements for securing data in transit and at rest across hybrid and multi-cloud environments.
6 months ago
Kill Chain
TARmageddon: Rust async-tar Supply Chain Flaw Leads to Critical RCE Risk
In June 2024, security researchers disclosed a critical vulnerability known as 'TARmageddon' in the abandoned Rust async-tar library and its forks. Attackers can exploit the flaw to achieve remote code execution (RCE) on systems using unpatched versions of the library, commonly found in developer tools and backend infrastructure. As async-tar remains unmaintained, organizations relying on affected forks or software inherit the vulnerability, potentially allowing initial compromise and lateral movement within supply chains. The flaw highlights the cascading risks of dependencies on abandoned open-source components, increasing the likelihood of stealthy supply-chain attacks bypassing traditional controls. This incident underscores a growing trend of adversaries targeting open-source software supply chains, particularly by exploiting abandoned or under-maintained libraries. The complexity and opacity of modern dependency trees, alongside escalations in software bill of materials (SBOM) scrutiny, make proactive vulnerability management and real-time supply-chain threat detection essential for reducing risk.
6 months ago
Kill Chain
Pwn2Own Ireland 2025: 56 Zero-Day Vulnerabilities Exposed in One Day
In May 2025, security researchers at the Pwn2Own Ireland contest successfully exploited 56 previously unknown zero-day vulnerabilities across a broad range of consumer and enterprise devices—including the latest Samsung Galaxy S25 smartphone—over the course of a single day, earning nearly $793,000 in rewards. Participants used advanced exploitation chains targeting device software, firmware, and novel attack surfaces to gain remote code execution and bypass layered security controls. The demonstration of these critical flaws underlined the sophistication of contemporary offensive security techniques and the persistent risk posed by undiscovered vulnerabilities in modern technology stacks. Vendors were immediately notified, but the affected products are widely used globally. This incident exemplifies the accelerating pace and scale at which new vulnerabilities are uncovered, often by highly skilled researchers using techniques similar to those seen in active threat landscapes. Organizations are facing increased regulatory pressure to address zero-day risks and are urged to respond rapidly to vendor advisories and emerging disclosures.
6 months ago
Kill Chain
TARmageddon: Remote Code Execution Risk in Popular Async-Tar Rust Library Uncovered (2025)
In late August 2025, researchers uncovered TARmageddon (CVE-2025-62518), a high-severity supply-chain vulnerability in the async-tar Rust library and its forks, including tokio-tar. This flaw could permit remote code execution (RCE) when processing maliciously-crafted tar archives, posing a significant risk to downstream applications and platforms relying on these libraries for file extraction and archive handling. Successful exploitation opens the door to system compromise, data loss, or service interruption for potentially thousands of applications leveraging async-tar in production workloads. This incident highlights the growing threat of software supply-chain vulnerabilities, especially within open-source dependencies widely adopted across cloud-native and DevSecOps environments. Organizations must closely monitor dependencies, establish strong vulnerability management pipelines, and rapidly respond to disclosures as attackers increasingly target the software supply chain.
6 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
6 months ago
Kill Chain
China-Nexus Threat Actors Weaponize 'Nezha' RAT for Stealthy Campaigns in 2024
In early 2024, cybersecurity researchers uncovered a new campaign by China-nexus threat actors leveraging the open source "Nezha" remote access tool (RAT) to facilitate covert network access and persistence. Unlike traditional RMM (Remote Monitoring and Management) abuse, the adversaries deployed Nezha across multiple victim environments to enable encrypted traffic tunneling, conduct command-and-control operations, and bypass security controls. Targeting enterprises in various sectors, the attackers exploited weak access controls and east-west network traffic to establish lateral movement pathways, with the operation resulting in significant risks to sensitive data and business continuity. This incident highlights an accelerating trend in the use of open source, commodity tools by nation-state-aligned actors to evade detection and complicate attribution. The campaign reflects shifting threat dynamics, as attackers weaponize cloud-native techniques and legitimate tools to target organizations seeking to modernize security controls and comply with frameworks such as NIST and PCI DSS.
6 months ago
Kill Chain
LockBit, Qilin & DragonForce Forge Ransomware Cartel in 2024
In early 2024, notorious ransomware groups LockBit, Qilin, and DragonForce announced a strategic partnership, effectively forming a collaborative ransomware 'cartel.' This alliance has seen these gangs pooling resources, intelligence, and attack methods, shortly after the release of LockBit 5.0. By inviting other e-crime affiliates, they have expanded their operational reach and attack surface across multiple industries. The cartel model increases both the speed and sophistication of attacks, complicating defenders' response and extending the lifecycle of compromised environments for criminal profit. The incident is particularly relevant as it signals a new phase in ransomware operations, with threat actors adopting formal, syndicate-like coordination. It highlights escalating risks for enterprises, as collective intelligence sharing among attackers can quickly disrupt even mature security postures.
6 months ago
Kill Chain
Chaos Ransomware's C++ Upgrade: The 2024 Threat Every Enterprise Must Face
In early 2024, the Chaos Ransomware-as-a-Service operation unleashed a potent new C++ variant, featuring advanced encryption, wiper functionalities, and cryptocurrency-stealing modules. This evolution targets a broad array of victims by leveraging aggressive lateral movement across networks, rapid data encryption, and selective data destruction to intensify pressure on organizations. The threat actors deploy sophisticated evasion tactics and can pivot across cloud and hybrid infrastructures, resulting in operational disruptions and financial losses, especially in environments lacking east-west traffic controls and advanced detection capabilities. The Chaos ransomware upgrade exemplifies a broader trend of rapidly advancing ransomware toolkits integrating destructive and extortion-focused modules. With a spike in cross-industry ransomware incidents and escalating regulatory pressure to remediate compliance gaps, organizations must urgently reevaluate defenses, with emphasis on segmentation, visibility, and high-speed encrypted traffic controls.
6 months ago
Kill Chain
SonicWall 2024: Every Cloud Firewall Backup Breached in Major Supply Chain Attack
In June 2024, SonicWall confirmed that the previously disclosed breach of its cloud backup service was far more extensive than initially announced. The attack resulted in unauthorized access to firewall configuration backups for 100% of customers using SonicWall's cloud backup platform, rather than the 5% originally estimated. The compromise exposed sensitive customer network data, including credentials and VPN configurations, after attackers exploited vulnerabilities in SonicWall’s systems. This breach underscores significant supply chain risks, as attackers targeted third-party-managed infrastructure to circumvent perimeter defenses. This incident highlights the rising threat of supply chain attacks targeting security vendors themselves, which can expose downstream customer environments. With increasing regulatory scrutiny and heightened awareness of lateral movement risks across managed services, organizations must revisit both technical and vendor controls to ensure comprehensive zero trust segmentation and backup protection.
6 months ago
Kill Chain
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports