✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Nation-State Ransomware: Storm-2603 Exploits Velociraptor in 2024 Attacks
In early 2024, the Storm-2603 threat group, attributed to Chinese nation-state actors, conducted a series of ransomware campaigns leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool. By abusing Velociraptor, the attackers achieved persistent access, lateral movement, and stealthy data collection within targeted corporate environments. The group exploited weaknesses in east-west traffic security and endpoint controls, using legitimate tooling to evade detection and deploy ransomware payloads, leading to operational disruption and potential data exfiltration for multiple organizations. This incident highlights an escalation in adversaries’ use of legitimate IT and forensics tools for malicious purposes, complicating detection strategies. It exemplifies the growing threat of "living-off-the-land" tactics, where attackers blend in with standard operations, underscoring the need for improved anomaly detection, zero trust segmentation, and lateral movement controls.
6 months ago
Kill Chain
Feds Dismantle ShinyHunters' Salesforce Extortion Hub: Lessons for Cloud Security
In June 2024, U.S. federal authorities dismantled an extortion portal run by the notorious ShinyHunters group, which was used to threaten Salesforce victims after a reported compromise. ShinyHunters is known for data theft and double-extortion tactics, leveraging public leaks and ransom demands to extort organizations. Despite law enforcement takedown efforts, the group's threats remain active, targeting businesses that rely on Salesforce for their customer and operational data. The attack highlights risks surrounding third-party SaaS platforms and sophisticated cybercriminal techniques that exploit sensitive, cloud-based systems for extortion. This event underscores the accelerating landscape of data extortion and the persistent threat from established ransomware and data-leak actors. As organizations increasingly depend on SaaS providers, regulators and enterprises are intensifying focus on zero trust access, east-west traffic security, and layered controls to contain lateral movement and prevent sensitive data exposure.
6 months ago
Kill Chain
Pixnapping Attack: How Android 2FA Was Bypassed in 2024
In early 2024, researchers discovered a novel mobile vulnerability known as the 'Pixnapping' attack, which targeted Android applications to circumvent two-factor authentication (2FA) mechanisms. The attack leverages cleverly crafted overlays to capture sensitive information directly from protected apps such as Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo. While there is no evidence of widespread exploitation, the proof-of-concept demonstrates that malicious apps with appropriate permissions could bypass Android security boundaries, enabling attackers to steal both credentials and 2FA tokens, thereby jeopardizing highly sensitive user data on compromised devices. This incident underscores the urgent need for stronger in-app security controls and constant vigilance regarding permission granularity on mobile platforms. As more threat actors focus on mobile endpoints and multi-factor authentication, organizations and users must adapt their defenses to counter increasingly sophisticated and evasive attack methods.
6 months ago
Kill Chain
Microsoft's October 2025 Zero-Day Storm: What the Massive Patch Update Means for Your Business
In October 2025, Microsoft released a massive Patch Tuesday security update addressing over 100 vulnerabilities across its product suite, including multiple actively exploited zero-days and several high-severity privilege escalation flaws. Threat actors leveraged some of these unpatched vulnerabilities to gain elevated access to enterprise and government systems, exploiting both on-premises and cloud workloads. The update also marked the final round of Windows 10 security patches, raising urgency for legacy system owners to upgrade in order to remain protected. The overall business impact included increased risk of lateral movement, data exfiltration, service disruptions, and heightened remediation costs for organizations slow to patch. This incident underscores an ongoing trend of attackers rapidly weaponizing newly disclosed vulnerabilities, as well as the growing threat facing organizations who rely on end-of-life software. The scale and speed of exploit adoption highlight the critical importance of vulnerability management and proactive patching as top security priorities.
6 months ago
Kill Chain
F5 BIG-IP Breach 2024: Nation-State Attackers Exploit Zero-Day Flaws
In June 2024, F5 Networks disclosed a significant security breach impacting its BIG-IP application delivery products. The incident involved a nation-state threat actor exploiting previously unknown (zero-day) vulnerabilities to gain unauthorized access to F5’s internal systems. Attackers reportedly obtained proprietary source code and, in some cases, limited customer information. Sophisticated post-exploitation techniques were used to move laterally and exfiltrate sensitive data, highlighting the attacker’s expertise and persistence. The breach raises concerns around the supply-chain risk for organizations deploying F5 BIG-IP solutions, as exploitation of this trusted infrastructure could jeopardize downstream customer networks. This incident underscores the escalating trend of nation-state actors targeting critical infrastructure and supply-chain vendors through advanced, stealthy attack methods. Given the widespread use of F5 products in enterprise and government IT environments, the breach has heightened industry awareness around zero-day vulnerabilities and supply-chain security best practices.
6 months ago
Kill Chain
Harvard University Breached by Clop Ransomware: Oracle Zero-Day Attack Exposes Data
In the first half of 2024, Harvard University fell victim to a significant cyberattack orchestrated by the Clop ransomware group, exploiting a zero-day vulnerability in Oracle software. The threat actors gained unauthorized access to sensitive university data, exfiltrating large volumes as part of a broader campaign that targeted Oracle customers worldwide. The breach showcases how sophisticated ransomware groups leverage software supply chain weaknesses, often exploiting vulnerabilities before patches become available. As a result, Harvard faced disruption of operations, regulatory scrutiny, and potential exposure of sensitive academic and financial data. This incident underscores the escalating trend of ransomware operations exploiting zero-day flaws to target major institutions, particularly in the education sector. The attack highlights urgent needs for advanced segmentation, rapid patching, and proactive lateral movement prevention as ransomware groups become more aggressive and opportunistic.
6 months ago
Kill Chain
Microsoft VS Code Marketplace Plugins Leak Sensitive Secrets: Supply Chain Alert
In early 2024, security researchers uncovered over 550 unique authentication secrets (such as API keys and credentials) leaking from extensions published on Microsoft's Visual Studio Code Marketplace. The exposed secrets, embedded within third-party extensions, created a major supply chain risk by potentially allowing attackers to compromise developer environments or escalate access to sensitive systems. Microsoft responded by enhancing its security review process, warning affected publishers, and initiating additional controls to prevent similar exposures in the future. This incident highlights the growing risks tied to open software ecosystems, where attackers increasingly target supply chain dependencies. With developer tools and plugin marketplaces at the core of modern workflows, secret leakage could enable widespread compromise, pushing organizations to urgently strengthen code supply chain security and compliance.
6 months ago
Kill Chain
Phishing Surge Exposes Password Manager Vulnerabilities: Lessons from the 2024 LastPass Incident
In early 2024, a series of highly targeted phishing campaigns were launched against users of LastPass and other leading password managers. Threat actors masqueraded as trusted service communications to exploit user trust, distributing convincing emails and fraudulent alerts to trick victims into providing master credentials or installing malicious software. Despite existing security controls, the attackers leveraged sophisticated social engineering and exploited the single point of failure inherent to password vaults, putting sensitive enterprise and personal accounts at risk. The attack underscores the vulnerability of credential management platforms to phishing-driven infiltration and the potential for widespread credential compromise. This incident highlights a surge in credential phishing tactics aimed at circumventing advanced security measures by exploiting human error. As password managers become more widespread, attackers are evolving methods to target the trust users place in these tools, emphasizing the need for continuous security awareness, robust MFA adoption, and proactive anomaly detection around high-value authentication solutions.
6 months ago
Kill Chain
Microsoft Halts Rhysida Ransomware Campaign Abusing Azure Certificates
In early 2024, Microsoft uncovered and disrupted a sophisticated ransomware campaign in which attackers abused more than 200 stolen or forged Azure Active Directory certificates to sign malicious Microsoft Teams binaries. This campaign, attributed to the Rhysida ransomware group, enabled threat actors to appear as legitimate Microsoft services, bypassing security controls and delivering the final ransomware payloads to targeted enterprise environments. Following detection, Microsoft swiftly revoked the malicious certificates and worked with affected customers to mitigate the threat, limiting further operational and financial damage. This incident underscores the increased attacker focus on abusing trusted cloud identities and supply chain trust mechanisms to facilitate stealthy lateral movement and ransomware deployment. Organizations are now under greater pressure to strengthen certificate governance, cloud identity monitoring, and east-west traffic security controls as threat actors escalate the abuse of cloud-native infrastructure.
6 months ago
Kill Chain
How Flawed Vendor Guidance Led to Oracle WAF Attacks in 2024
In 2024, Oracle E-Business Suite customers became vulnerable after the company released flawed guidance on deploying its Web Application Firewall (WAF), failing to mitigate a critical zero-day vulnerability. The lack of effective instructions enabled threat actors to exploit the misconfiguration, leading to ransomware attacks and potential data breaches for numerous enterprises. Attackers leveraged the window before official patches or updated configurations, gaining lateral movement and access to sensitive business operations. This incident highlighted how vendor missteps in supply-chain security can cascade across customer environments, amplifying operational risk and compliance exposure. The breach underscores the increasing risk associated with supply-chain vulnerabilities and misaligned vendor guidance. As sophisticated threats target misconfigurations and third-party solutions, organizations must reassess their reliance on default vendor instructions and proactively harden their environments against emerging TTPs.
6 months ago
Kill Chain
MuddyWater Hits Middle East Governments: Phishing, Phoenix Backdoor & VPN Abuse
In early 2024, the Iranian state-sponsored group MuddyWater orchestrated a large-scale spear-phishing campaign targeting over 100 government entities across the Middle East and Africa. Attackers leveraged a compromised mailbox and NordVPN to distribute phishing emails enticing recipients to enable malicious macros. This led to the deployment of the Phoenix backdoor, providing attackers with persistent access and the ability to move laterally within targeted organizations’ networks, thereby raising concerns over significant data exposure and long-term espionage. The MuddyWater incident exemplifies the growing sophistication and scale of nation-state phishing campaigns. Recent trends show attackers are rapidly adapting credential theft and post-exploitation tactics to bypass traditional defenses. Government entities face mounting regulatory and operational pressure to address advanced persistent threats exploiting email and remote access.
6 months ago
Kill Chain
Scattered LAPSUS$ Hunters Target Encrypted Traffic in 2024 Hybrid Cloud Breach
In early 2024, the cybercrime group Scattered LAPSUS$ Hunters was observed launching a series of attacks targeting high-performance encrypted traffic between enterprise environments. Leveraging advanced tactics such as packet sniffing and lateral movement across hybrid and multicloud networks, the group exploited weak internal segmentation and gaps in east-west traffic controls. The attackers circumvented some organizations’ use of line-rate encryption by targeting less-protected internal flows and using sophisticated threat detection evasion techniques. Operational impacts included service disruptions, potential data exfiltration, and compromised cloud environments. This incident underscores the evolution of cybercrime actors as they adopt more advanced methods to breach environments assumed to be protected by conventional encryption or traditional network segmentation. The trend highlights growing risks for enterprises relying on hybrid and multicloud infrastructure, and illustrates the urgent need for zero trust approaches and enhanced east-west traffic security.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports