✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Remote Code Execution Flaw in Abandoned Rust Library Exposes Global Supply Chain
In August 2024, Edera researchers discovered CVE-2025-62518, a high-severity remote code execution vulnerability in the abandoned async-tar library for the Rust programming language. This logic flaw, named "TARmageddon," was unwittingly propagated to millions of users through downstream forks like tokio-tar and widely used build tools such as uv and testcontainers. The systemic risk arises because the vulnerability was replicated across a deep lineage of forks, making it very difficult to detect and patch comprehensively. Exploitation allows attackers to achieve remote code execution by overwriting files via malicious tar archives—a threat amplified by the lack of direct visibility into indirect dependencies in modern supply chains. The incident is especially impactful as it highlights the persistent risks of open-source abandonware and insufficient maintenance of foundational software libraries. It underscores growing industry focus on supply-chain security, indirect dependency management, and the need for rapid, coordinated vulnerability disclosure and remediation.
6 months ago
Kill Chain
Velociraptor Misused: LockBit Ransomware & Storm-2603 Weaponize DFIR Tools in 2025 Attacks
In October 2025, cybersecurity researchers uncovered that threat actors associated with Storm-2603 (also known as Gold Salem or CL-CRI-1040) leveraged Velociraptor, a legitimate open-source digital forensics and incident response (DFIR) tool, to facilitate a series of LockBit ransomware attacks. Adversaries exploited Velociraptor’s capabilities to gather intelligence and move laterally within target environments, evading detection by blending in with regular security operations. The attacks led to significant data encryption events and operational disruptions, primarily impacting organizations with insufficient internal security segmentation and monitoring. This incident marks a significant evolution in attacker tradecraft, as it demonstrates that widely trusted security tools—often present for defensive use—can be repurposed as offensive weapons. Increased regulatory scrutiny and the recurrent rise of double extortion ransomware attacks highlight the urgent need for organizations to monitor tool usage and improve east-west visibility.
6 months ago
Kill Chain
SonicWall VPN Breach 2025: Over 100 Customer Accounts Compromised via Stolen Credentials
In October 2025, a widespread compromise targeted SonicWall SSL VPN devices, enabling attackers to gain unauthorized access to at least 100 customer accounts across various organizations. Security firm Huntress noted that threat actors rapidly authenticated using valid credentials on multiple devices, suggesting credential theft or data leaks rather than brute-force attacks. Attackers leveraged VPN access to infiltrate corporate environments, enabling lateral movement and potentially exfiltrating sensitive data. This campaign demonstrates the heightened risk posed by stolen credentials, especially when VPN infrastructure is directly exposed to the internet. This incident is highly relevant as credential-focused attacks and VPN compromises continue to surge, exploiting weaknesses in remote access systems. The event underscores the urgent need for zero trust strategies and stronger authentication measures to defend against evolved attacker tactics targeting perimeter defenses.
6 months ago
Kill Chain
Oracle E-Business Suite Hit by Critical Unauthenticated Data Exposure Vulnerability
In October 2025, Oracle disclosed a high-severity vulnerability (CVE-2025-61884) affecting E-Business Suite versions 12.2.3 through 12.2.14. This flaw allows unauthenticated attackers to access sensitive data without login, leveraging a network-exploitable bug rated CVSS 7.5. Organizations running impacted Oracle EBS versions are at risk of data compromise, business disruption, and regulatory exposure if left unpatched. Oracle issued a security alert and urgent patch to address the issue as exploitation attempts in the wild are anticipated. This disclosure underscores the growing trend of unauthenticated, remote data access flaws targeting ERP platforms. Critical business applications present attractive targets for threat actors, especially as organizations expand interconnectivity. Prompt detection and segmentation of east-west traffic remain essential as ERP vulnerabilities increasingly underpin large-scale, compliance-relevant breaches.
6 months ago
Kill Chain
ChaosBot Unleashed: Rust-Based Malware Breach Leverages Discord and Stolen Credentials
In October 2025, security researchers identified a targeted cyberattack involving a new Rust-based backdoor known as ChaosBot. The threat actors initially leveraged compromised credentials associated with both a Cisco VPN account and an over-privileged Active Directory service account, enabling them to gain stealthy remote access to victims’ environments. Once inside, ChaosBot connected to adversary-controlled Discord channels for command-and-control and allowed attackers to perform reconnaissance, execute arbitrary commands, and potentially move laterally through affected networks. The incident underscores attackers' increasing reliance on credential abuse, novel malware written in memory-safe languages, and abuse of popular cloud-based collaboration tools for C2, ultimately increasing the risk of data exfiltration and operational disruption for enterprises reliant on hybrid identity and VPN solutions. This incident exemplifies the growing threat of multi-vector identity compromise combined with cloud and modern malware tradecraft. Its emergence highlights the urgent need for organizations to adopt zero trust access controls, enforce strict privilege management, and monitor for suspicious activity across both cloud and on-premises assets.
6 months ago
Kill Chain
Microsoft Shuts Down IE Mode After Zero-Day Exploit Exposes Legacy Risks
In August 2025, Microsoft responded to credible reports that unknown threat actors exploited Internet Explorer (IE) mode in the Edge browser. Attackers used a combination of unpatched (zero-day) JavaScript vulnerabilities and basic social engineering to compromise legacy IE mode, which allowed unauthorized access to Windows devices. The exploitation leveraged backward compatibility for legacy web apps, serving as an entry point for attackers to install persistent backdoors and potentially exfiltrate sensitive data. Microsoft swiftly revamped and locked down IE mode to prevent further abuse, minimizing ongoing risk and alerting organizations reliant on legacy web technologies. This incident underscores the persistent risks of maintaining backward compatibility for legacy browser features. As attackers increasingly target older components embedded within modern platforms, organizations face new urgency to accelerate deprecation plans and strengthen zero trust security controls.
6 months ago
Kill Chain
RondoDox Botnet 2025: Mass Exploitation Sheds Light on Multi-Vendor Security Gaps
In October 2025, security researchers uncovered a major campaign involving the RondoDox botnet, which rapidly weaponized over 50 vulnerabilities across more than 30 device vendors. The attack leveraged an "exploit shotgun" approach, targeting a vast range of internet-facing infrastructure including routers, DVRs, NVRs, CCTV systems, and web servers. Threat actors behind RondoDox employed automated scanning and exploitation, compromising vulnerable devices at scale for botnet expansion, distributed denial-of-service (DDoS) attacks, and potential further malicious activity. The operational impact included service degradation, widespread risk of breach propagation, and the exposure of inadequately secured assets across diverse environments. This incident highlights a surging trend in large-scale, opportunistic exploitation—where attackers rapidly integrate newly disclosed vulnerabilities into botnet tools. The scale and automation reflect the growing sophistication of threat actors, amplifying risks for businesses lagging in patch management and segmentation. Regulatory scrutiny is intensifying as such campaigns threaten critical infrastructure and data security.
6 months ago
Kill Chain
2025 Mega-Breach: WhatsApp Worm & Oracle 0-Day Power Ransomware Cartel Campaign
In October 2025, a sophisticated international cybercriminal cartel launched a coordinated multi-vector campaign targeting organizations worldwide. The attackers leveraged a newly discovered zero-day vulnerability in Oracle middleware, chaining it with several critical CVEs and a rapidly spreading WhatsApp worm. Lateral movement was facilitated via unprotected east-west traffic and credential theft, allowing rapid compromise of hybrid cloud environments and on-premises resources. The impact included ransomware deployment, data exfiltration, and significant operational disruptions across sectors such as finance, healthcare, and technology. This incident highlights the unsettling trend of threat actors collaboratively exploiting multiple weaknesses—including unpatched systems, misconfigurations, and trusted collaboration tools—to bypass traditional defenses. The convergence of wormable malware, supply chain vulnerabilities, and ransomware-as-a-service underscores the necessity for adaptive security and real-time threat detection.
6 months ago
Kill Chain
TA585’s MonsterV2: Unveiling 2025’s Next-Gen Phishing Infostealer Threat
In October 2025, cybersecurity researchers uncovered new activities by the previously undocumented threat actor TA585, which was observed conducting sophisticated phishing attacks to deliver the MonsterV2 infostealer malware. The group leveraged advanced tactics, including web injections and traffic filtering, to evade detection and ensure payload delivery. Once deployed, MonsterV2 enabled TA585 to harvest sensitive information and credentials, posing significant risks to organizational data integrity and confidentiality. The attack chains exploited weaknesses in email security and endpoint controls, demonstrating a concerning evolution in social engineering and malware delivery. This incident highlights the growing prevalence of stealthy infostealer campaigns targeting enterprises across multiple sectors. It underscores the urgent need for organizations to reevaluate network segmentation, multi-cloud visibility, and anomaly detection strategies to counter increasingly capable threat actors and align with evolving compliance standards.
6 months ago
Kill Chain
How Malicious Open Source Packages Used Discord to Breach Developer Supply Chains in 2025
In October 2025, security researchers uncovered a widespread supply chain attack targeting popular open source repositories—including npm, PyPI, and RubyGems. Malicious packages were uploaded to these ecosystems and leveraged Discord webhooks as a covert command-and-control (C2) channel to exfiltrate sensitive developer data upon installation. The attackers took advantage of the ease of publishing code to open source registries, embedding scripts that silently siphoned credentials, environment variables, and other project secrets. Dozens of projects and potentially thousands of developers or organizations were impacted, risking further compromise via credential leakage and downstream dependency poisoning. This incident underscores the urgency of enforcing robust dependency hygiene and highlights a rising trend: attackers increasingly abusing trusted supply chains and common collaboration tools for exfiltration. As open source usage soars and supply chain security intensifies, organizations must be vigilant against covert exfiltration methods and adopt multilayered security controls.
6 months ago
Kill Chain
Pixnapping: The Android Flaw Allowing Rogue Apps to Bypass 2FA Security (2025 Breach Analysis)
In October 2025, security researchers from the University of California, Berkeley, uncovered a critical vulnerability affecting Google and Samsung Android devices. The flaw, dubbed "Pixnapping," enables malicious apps to perform pixel-by-pixel side-channel attacks, covertly extracting two-factor authentication (2FA) codes, mapping data (such as Google Maps timelines), and other sensitive on-screen information—all without any special permissions or user awareness. Threat actors can exploit this vulnerability by luring users into installing rogue apps, ultimately undermining common security practices that rely on device or app isolation to keep critical data secure. This incident highlights an increasing trend of advanced side-channel techniques targeting mobile devices, even in environments with strict permission models. As mobile malware continues to evolve, organizations and individuals must stay vigilant, adapt security controls, and reevaluate the effectiveness of current detection and segmentation approaches to safeguard sensitive data.
6 months ago
Kill Chain
AMD RMPocalypse: 2025 SEV-SNP Hardware Flaw Shakes Confidential Computing
In October 2025, researchers from ETH Zürich disclosed a critical vulnerability, dubbed RMPocalypse, affecting AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. The flaw allowed attackers to undermine confidential computing protections by exploiting incomplete memory protections, making it feasible to alter a single 8-byte memory location and bypass hardware security boundaries. This discovery prompted AMD to release urgent patches across impacted EPYC server platforms, as the risk permitted threat actors—potentially including malicious tenants or insiders in cloud environments—to access sensitive workload data previously thought to be isolated and encrypted. This incident highlights persistent risks within hardware-assisted security frameworks and confidential computing platforms, as attackers increasingly target trusted execution environments. With a rise in high-confidence threats and supply-chain attacks, this breach sets a new precedent for cross-layer vulnerability research and the urgency of continuous hardware and firmware security validation.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports