✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Fortra GoAnywhere MFT Breach: How CVE-2025-10035 Enabled a Major Ransomware Attack
In September 2025, Fortra disclosed that its GoAnywhere Managed File Transfer (MFT) platform suffered from a critical vulnerability (CVE-2025-10035) that was actively exploited by threat actors. Attackers leveraged this flaw—reportedly requiring a private cryptographic key, the origins of which are still unclear—to gain unauthorized access, moving laterally within cloud-based environments and exfiltrating data. Notably, Microsoft attributed ransomware intrusions and multi-stage attacks to a criminal group tracked as Storm-1175, leading to business disruptions and heightened risk for GoAnywhere users. Fortra responded by patching its services, investigating suspicious activity, and notifying affected customers, though questions remain regarding the root cause and extent of private key compromise. This incident highlights the growing risk of supply chain and third-party software vulnerabilities being exploited in ransomware campaigns. The exploitation of cryptography-dependent mechanisms signals an evolving sophistication among threat actors, pressing organizations to reconsider approaches to privileged cryptographic assets and drive urgency in patch management.
6 months ago
Kill Chain
Harvard University Hit by Clop Ransomware Through Oracle Zero-Day Exploit in 2025
In October 2025, Harvard University disclosed an ongoing investigation into a cybersecurity breach linked to the exploitation of a zero-day vulnerability (CVE-2025-61882) in Oracle's E-Business Suite servers. The Clop ransomware gang claimed responsibility after adding Harvard to its data leak site, stating sensitive administrative data was stolen and threatening public release if ransom demands were not met. The attack was part of a broader campaign targeting Oracle E-Business Suite customers globally, exploiting the flaw for extortion and data theft. Harvard applied the vendor’s emergency patch upon notification and reported the breach as limited to a small administrative unit, with no signs of further compromise. This incident underscores the continuous risk universities and other organizations face from sophisticated ransomware groups leveraging zero-day exploits to bypass conventional defenses. The rapid exploitation of newly discovered vulnerabilities and subsequent data thefts reflect an ongoing shift towards extortion-focused campaigns targeting high-profile institutions and critical business systems.
6 months ago
Kill Chain
Oracle E-Business Suite 2025 Flaw Sparks Urgent Clop Ransomware Concerns
In October 2025, Oracle issued an emergency patch addressing CVE-2025-61884, a critical information disclosure vulnerability in its E-Business Suite (EBS) affecting versions 12.2.3 through 12.2.14. The flaw, present in the Runtime UI component, allowed unauthenticated attackers to remotely access sensitive business data, bypassing standard authentication mechanisms. The incident followed the discovery that threat actors—most notably the Clop ransomware group—had recently targeted Oracle EBS zero-days in extortion schemes against executives, leveraging vulnerabilities to facilitate large-scale data theft. Although Oracle has not confirmed active exploitation of CVE-2025-61884, the urgency of the patch highlights heightened threat actor interest and continued risk for organizations with unpatched, internet-facing EBS deployments. This incident underscores an alarming trend: criminal groups exploiting zero-day and recently patched vulnerabilities in widely used business applications for extortion and data theft. The rapid evolution of attacker tactics, combined with the continued exposure of critical SaaS and ERP platforms, raises the stakes for organizations to accelerate patching cycles and strengthen segmentation and threat detection strategies.
6 months ago
Kill Chain
SonicWall VPN Breach 2025: Credential Theft Sparks Widespread Compromise
In October 2025, a widespread cyberattack compromised more than 100 SonicWall SSLVPN accounts across 16 customer environments through the use of stolen, valid credentials. Researchers at Huntress observed the attackers rapidly authenticating into multiple accounts, with some sessions ending abruptly while others progressed to network reconnaissance and attempts at lateral movement by targeting local Windows accounts. The campaign began around October 4, 2025, with most attack traffic tracing back to a single IP address. Although there is no direct link to a previous breach involving SonicWall firewall configuration files, the incident underscores a substantial exposure risk to sensitive systems, business operations, and potentially regulatory compliance requirements. This incident highlights the evolving threat landscape, where credential compromise—not brute force—enables rapid, large-scale intrusions into VPN infrastructures. The continued prevalence of identity-driven attacks against remote access systems amplifies the urgency for enhanced credential hygiene, multi-factor authentication, and zero-trust access controls in the face of sophisticated adversaries.
6 months ago
Kill Chain
Massive Multi-Country Botnet Launches RDP Attacks Against US Organizations
In October 2025, a massive botnet composed of devices spanning over 100 countries launched coordinated attacks targeting Remote Desktop Protocol (RDP) services in the United States. Security researchers first spotted a spike in unusual RDP traffic originating from Brazil, with further malicious activity quickly spreading globally. Attackers leveraged two primary techniques: RD Web Access timing attacks to infer valid usernames, and RDP web client login enumeration to access accounts through analysis of server response behaviors. The campaign utilized over 100,000 unique IP addresses sharing a similar TCP fingerprint, indicating a highly organized cluster-based operation. The attacks put both government and enterprise systems at risk of brute-force intrusion and potential credential compromise. This incident underlines the persistent and evolving threat posed by botnets against remote access services. With increasing remote work reliance and exposed RDP endpoints, such sophisticated, multi-geography attacks exploit common authentication weaknesses and call for urgent upgrades in defense, including MFA and network segmentation.
6 months ago
Kill Chain
Microsoft 2025: Zero-Day Exploit Prompts Emergency IE Mode Restrictions
In October 2025, Microsoft announced urgent restrictions on Internet Explorer (IE) mode within the Edge browser following the discovery of active zero-day exploits targeting the Chakra JavaScript engine. Threat actors leveraged sophisticated social engineering tactics to lure users to spoofed sites, where a previously unknown vulnerability in Chakra enabled remote code execution. Attackers combined this with a privilege escalation flaw to escape the browser sandbox and seize complete device control. Microsoft responded by removing easy methods to activate IE mode in Edge for consumer users, instead requiring manual configuration limited to explicit, approved sites, and urged migration from legacy technologies. This incident underscores the persistent risks associated with maintaining legacy web compatibility features such as IE mode, especially as threat actors increasingly exploit these pathways with sophisticated chains of zero-day vulnerabilities and social engineering. It highlights heightened urgency for organizations to migrate from deprecated software and rigorously manage legacy access points.
6 months ago
Kill Chain
SimonMed Data Breach Exposes Over 1.2 Million Patient Records in 2024
In January 2024, SimonMed Imaging, a major U.S. provider of diagnostic medical imaging, disclosed a data breach impacting over 1.2 million patients. The incident involved unauthorized access to internal systems, which allowed attackers to exfiltrate sensitive health and personal information—including names, birthdates, contact information, health insurance and medical data. The breach was discovered during routine security monitoring, after which SimonMed implemented containment measures and engaged third-party forensics. Regulatory authorities and affected individuals were promptly notified, with the company offering support and identity protection services where relevant. This breach underscores the persistent targeting of healthcare organizations due to the high value of medical data, as well as regulatory scrutiny around the protection of patient information. It highlights the growing sophistication of data exfiltration tactics, emphasizing the critical need for robust east-west security controls, encrypted traffic, and rapid anomaly detection within healthcare IT environments.
6 months ago
Kill Chain
Bling Libra’s 2024 Extortion: Lessons from a Modern Ransomware Attack
In early 2024, a cybercriminal alliance known as Bling Libra—aligned with the notorious Scattered Spider and Lapsus$—launched coordinated extortion campaigns targeting retail and hospitality organizations worldwide. Using a mixture of credential theft, social engineering, and advanced lateral movement, attackers bypassed security controls to gain privileged access to sensitive systems, disrupted operations, and exfiltrated confidential data. Victims faced steep ransom demands and public threats of data disclosure if payments were not met, resulting in loss of business continuity, reputational harm, and regulatory scrutiny. This incident highlights the mounting prevalence of extortion-based tactics that leverage both data theft and operational disruption. Organizations across multiple industries are now seeing an increase in sophisticated, multi-stage attacks fueled by agile, loosely affiliated threat actor groups determined to exploit gaps in cyber defenses.
6 months ago
Kill Chain
Russian ClayRat Android Spyware Masquerades as Popular Apps, Spreads Rapidly in 2024
In mid-2024, security researchers at Zimperium discovered ClayRat, a rapidly evolving Android spyware campaign targeting users in Russia. Disguised as trusted apps like TikTok and YouTube, ClayRat was spread via phishing websites and Telegram channels, infecting over 600 devices in just three months. Once installed, the spyware leverages Android’s SMS handler permissions to bypass typical security prompts, allowing attackers to covertly access messages, call logs, device information, and even remotely control infected phones. The highly orchestrated campaign abused social engineering, web deception, and obfuscation techniques to remain undetected, and can turn each compromised device into a new attack vector. The threat’s evolution signals rising global risks, as the campaign’s tactics can easily adapt to new payloads and regions. With increasing use of mobile malware, organizations globally should reassess mobile security controls and user awareness programs to defend against sophisticated, evasive spyware attacks exploiting trust in well-known apps.
6 months ago
Kill Chain
Apple Bug Bounty Shatters Records: $2M Now Offered for Zero-Click RCE Vulnerabilities
In June 2024, Apple significantly enhanced its bug bounty program, now offering up to $2 million for zero-click Remote Code Execution (RCE) vulnerabilities — the highest payout in the industry to date. This expansion includes new research categories and a more transparent reward structure aimed at encouraging security researchers to responsibly disclose critical flaws, particularly those enabling attackers to compromise devices without user interaction. The move comes amid heightened concerns over sophisticated exploits, such as NSO Group’s Pegasus, which have targeted Apple’s platforms using zero-click attack chains that can bypass traditional security controls, threatening the confidentiality and security of end-users and enterprise data. The immediate relevance of Apple's program expansion is twofold: it recognizes the rapid evolution of threat actor capabilities and underscores the urgent need for robust vulnerability disclosure programs. As zero-click exploits gain momentum among both state actors and cybercriminals, organizations face increased regulatory and reputational risks from unpatched, high-impact vulnerabilities.
6 months ago
Kill Chain
Gladinet CentreStack & Triofox Zero-Day Leads to Chain Exploit and Remote Code Execution
In October 2025, threat actors exploited a zero-day vulnerability (CVE-2025-11371) in Gladinet’s CentreStack and Triofox file sharing solutions, used by thousands of businesses worldwide. The flaw, a local file inclusion (LFI) bug present in all current product versions, was leveraged to extract sensitive configuration data and trigger a previously known deserialization vulnerability (CVE-2025-30406), resulting in remote code execution (RCE). At least three organizations have confirmed exploitation as attackers gained unauthorized access before Gladinet issued a patch, forcing emergency mitigations that affected platform functionality. This incident highlights how chained vulnerabilities and rapid exploitation of zero-days continue to threaten cloud-based file sharing services. With attackers escalating LFI into full RCE, organizations face heightened pressure to improve visibility, patch agility, and enforce Zero Trust controls, especially amid growing regulatory scrutiny.
6 months ago
Kill Chain
Autonomous AI Hacking: The Tipping Point in Global Cybersecurity Risk (2025)
In mid-2025, a wave of autonomous AI-driven cyberattacks emerged globally, marking a pivotal evolution in threat activity. Across June through September, a combination of threat actors—including criminal groups and state-sponsored entities—leveraged advanced large language models (LLMs) and autonomous agent frameworks to conduct large-scale vulnerability discovery, network infiltration, and ransomware deployment. Attackers used tools like XBOW, HexStrike-AI, and AI-powered malware to execute rapid reconnaissance, credential harvesting, and automated extortion, targeting enterprises and critical infrastructure with unprecedented speed, scale, and sophistication. Businesses faced increased operational disruptions and data loss due to automated exploitation chains and persistent threats that outpaced traditional defense mechanisms. This wave of AI-enabled cyberattacks highlights a dangerous rise in the commoditization of sophisticated offensive tools and the diminishing window for detection and response. The incident underscores an urgent shift in the cyber threat landscape, with automation eroding the gap between disclosure and exploitation while spurring intense regulatory and industry focus on adaptive, AI-driven defense solutions.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports