Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 108 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1285–1296 / 3490 reports
Novo Nordisk 2026 Breach: A Wake-Up Call for Software Development Security
Pharmaceuticals4 months ago

Novo Nordisk 2026 Breach: A Wake-Up Call for Software Development Security

In March 2026, Novo Nordisk, a leading pharmaceutical company, experienced a significant security breach initiated through an exposed GitHub personal access token found in client-side JavaScript on a subdomain. The threat group FulcrumSec exploited this token to clone private repositories, harvest additional credentials, and infiltrate deeper into the company's network. Over a span of more than two months, the attackers exfiltrated approximately 1.3TB of sensitive data, including source code, proprietary drug information, clinical trial data, internal AI models, and personal information of healthcare professionals and clinical trial participants. The breach was publicly disclosed on June 11, 2026, after unauthorized access to internal IT systems was detected. This incident highlights the critical vulnerabilities in software development pipelines, particularly concerning secrets management and the security of code repositories. The reliance on hardcoded credentials and improperly scoped access keys within development environments presents a substantial risk. Organizations are urged to treat development platforms as production systems, enforce stringent secrets management practices, and implement robust monitoring to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical Security Alert: AVer PTC Cameras Vulnerable to Remote Code Execution (CVE-2026-40624)
Higher Education/Acadamia4 months ago

Critical Security Alert: AVer PTC Cameras Vulnerable to Remote Code Execution (CVE-2026-40624)

In June 2026, a critical vulnerability (CVE-2026-40624) was identified in AVer PTC series cameras, including models PTC500S, PTC115, PTC500+, and PTC115+. This flaw allows remote, unauthenticated attackers to execute arbitrary code via specially crafted web requests, potentially leading to full device compromise. The vulnerability affects all firmware versions of these models. AVer has released firmware updates to address this issue, and users are strongly advised to apply these patches promptly to mitigate the risk of exploitation. This incident underscores the ongoing security challenges in IoT devices, particularly in the surveillance sector. The ease of exploitation and the critical nature of the affected devices highlight the importance of regular firmware updates and robust network security practices to protect against emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities in Apollo Pharmacy's Blood Glucose Monitoring System APG-01 BT
Health Care / Life Sciences4 months ago

Critical Vulnerabilities in Apollo Pharmacy's Blood Glucose Monitoring System APG-01 BT

In June 2026, vulnerabilities were identified in the Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT, specifically affecting version 0x0110_v1.1.0. These vulnerabilities, CVE-2026-50034 and CVE-2026-52866, allow attackers within Bluetooth Low Energy (BLE) range to intercept sensitive health data and disrupt device connectivity. The first vulnerability enables unauthorized access to glucose measurement values, while the second allows an attacker to monopolize the device's BLE connection, preventing legitimate use. These issues highlight the critical need for robust security measures in medical devices, especially those utilizing wireless communication protocols. As healthcare increasingly relies on connected devices, ensuring the confidentiality and availability of patient data is paramount to maintaining trust and compliance with regulatory standards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fortinet Credential Exposure 2026: Massive 'FortiBleed' Campaign
Government Administration4 months ago

Fortinet Credential Exposure 2026: Massive 'FortiBleed' Campaign

In June 2026, a significant cybersecurity incident known as 'FortiBleed' exposed credentials associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways. Security researchers discovered a massive archive containing FortiGate firewall URLs, usernames, emails, and plaintext passwords from major corporations such as Chevron, Samsung, Foxconn, and Toyota. The attackers, reportedly Russian-speaking, executed over 1.1 billion credential attempts against 320,000 FortiGate VPN instances, leading to the compromise of Active Directory environments and, in some cases, the exfiltration of classified documents. Fortinet responded by emphasizing best practices like regular credential updates and enabling multi-factor authentication (MFA) to mitigate risks. This incident underscores the critical importance of robust credential management and the implementation of MFA, especially for internet-facing systems. The scale and sophistication of the 'FortiBleed' campaign highlight the evolving tactics of cyber adversaries and the necessity for organizations to proactively secure their network infrastructures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security
Computer Software/Engineering4 months ago

TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security

Between February and June 2026, the cybercriminal group TeamPCP executed a series of supply chain attacks, compromising over 1,000 open-source software packages. By infiltrating widely used tools such as Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, TeamPCP exploited vulnerabilities in CI/CD pipelines and AI development tools to inject malicious code, leading to the exfiltration of sensitive data and credentials. This campaign underscored the critical weaknesses in the software supply chain, particularly the reliance on unverified code dependencies and the lack of rigorous security checks in automated deployment systems. The incident highlights the urgent need for organizations to reassess their software development practices, emphasizing the importance of verifying the integrity of open-source components and implementing robust security measures within CI/CD pipelines. As supply chain attacks become more prevalent, the industry must prioritize security to prevent similar large-scale compromises in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055 Disclosed by F5
Financial Services4 months ago

Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055 Disclosed by F5

In June 2026, F5 disclosed two critical vulnerabilities in NGINX, identified as CVE-2026-42530 and CVE-2026-42055. These flaws reside in the ngx_http_v3_module and the ngx_http_proxy_v2_module/ngx_http_grpc_module, respectively. Unauthenticated remote attackers can exploit these vulnerabilities to cause denial-of-service conditions or execute arbitrary code on systems with non-default configurations. Exploitation leads to use-after-free or heap-based buffer overflow in the NGINX worker process, potentially resulting in system crashes or code execution, especially on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. The disclosure underscores the persistent risk posed by vulnerabilities in widely used web server software. Organizations relying on NGINX should promptly apply the provided security patches or implement recommended mitigations to prevent potential exploitation. This incident highlights the importance of regular security assessments and timely updates to maintain system integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple Addresses Critical Bluetooth Vulnerability in Beats Studio Buds
Consumer Electronics4 months ago

Apple Addresses Critical Bluetooth Vulnerability in Beats Studio Buds

In June 2026, Apple addressed a critical vulnerability (CVE-2025-20701) in its Beats Studio Buds wireless earbuds. This flaw allowed attackers within Bluetooth range to access the device's microphone without user consent, potentially enabling eavesdropping on conversations. The issue originated from a missing authentication mechanism in the Airoha Bluetooth audio SDK used in the earbuds. Apple released firmware update 1B211 to mitigate this risk, which is automatically applied when the earbuds are paired with an iPhone, iPad, or Mac. This incident underscores the importance of securing Bluetooth devices against unauthorized access. As wireless peripherals become more prevalent, ensuring robust authentication protocols is crucial to prevent potential breaches and protect user privacy.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
International Crackdown Dismantles SocGholish Botnet Tied to Evil Corp
Computer Software/Engineering4 months ago

International Crackdown Dismantles SocGholish Botnet Tied to Evil Corp

In June 2026, international law enforcement agencies, including Europol and Eurojust, executed Operation Endgame, targeting the SocGholish botnet linked to the Russian cybercrime group Evil Corp. This coordinated effort resulted in the cleansing of nearly 15,000 malware-infected WordPress websites and the dismantling of over 100 associated servers. SocGholish, active since at least 2017, operates by injecting malicious JavaScript into legitimate websites, tricking visitors into downloading fake browser updates that install malware, thereby granting attackers access to infected systems. The operation significantly disrupted Evil Corp's infrastructure, mitigating further cyber threats posed by this group. The success of Operation Endgame underscores the effectiveness of international collaboration in combating sophisticated cybercriminal networks. It highlights the critical need for organizations to maintain robust cybersecurity practices, including regular software updates, vigilant monitoring of web assets, and user education to recognize and avoid social engineering tactics employed by malware like SocGholish.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Nintendo's 2026 Data Breach: A Wake-Up Call for Third-Party Security
Computer Games4 months ago

Nintendo's 2026 Data Breach: A Wake-Up Call for Third-Party Security

In June 2026, Nintendo of America experienced a data breach through TinyPulse, a third-party service used for internal employee surveys. The cybercriminal group ShadowByt3$ claimed responsibility, alleging they exfiltrated approximately 859 MB of sensitive data, including employee names, email addresses, bank statements, and W-9 forms. Nintendo confirmed the breach but stated that only internal survey content from a small subset of employees was affected, with most information dating back several years. The company's internal systems, as well as customer and financial data, remained uncompromised. This incident underscores the growing threat posed by emerging ransomware groups like ShadowByt3$, which, despite their relatively recent appearance, are capable of targeting major corporations through third-party service vulnerabilities. Organizations must reassess their third-party risk management strategies to prevent similar breaches.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
F5 Releases Patches for Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055
Internet4 months ago

F5 Releases Patches for Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055

In June 2026, F5 disclosed two critical vulnerabilities in NGINX Open Source: CVE-2026-42530 and CVE-2026-42055, both with a CVSS v4 score of 9.2. CVE-2026-42530 is a use-after-free flaw in the ngx_http_v3_module, exploitable when NGINX is configured with the HTTP/3 QUIC module, potentially allowing remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. CVE-2026-42055 is a heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, triggered under specific configurations involving HTTP/2 proxying, which could also lead to remote code execution under similar conditions. F5 has released patches to address these vulnerabilities and recommends disabling HTTP/3 and adjusting configuration directives as interim mitigations. The discovery of these vulnerabilities underscores the persistent risks associated with widely used open-source software components. Organizations relying on NGINX should promptly apply the provided patches and review their configurations to mitigate potential exploitation. This incident highlights the importance of continuous monitoring and timely updates to maintain the security of critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Gentlemen Ransomware's Advanced EDR Killers: A 2026 Threat Analysis
Financial Services4 months ago

Gentlemen Ransomware's Advanced EDR Killers: A 2026 Threat Analysis

In June 2026, the Gentlemen ransomware-as-a-service (RaaS) operation was observed actively developing and deploying a suite of endpoint detection and response (EDR) killer tools to evade detection during attacks. The primary tool, dubbed 'GentleKiller,' has at least eight variants that impersonate legitimate security products such as Kaspersky, Valorant, Javelin, and WatchDog. These tools utilize the 'bring your own vulnerable driver' (BYOVD) technique to gain kernel-level privileges and disable security processes, targeting over 400 processes associated with approximately 48 security vendors, including Microsoft, CrowdStrike, and SentinelOne. The binaries are protected using commercial packers like Enigma and Themida, and some variants employ stolen digital signatures to further obfuscate their malicious activities. This development underscores a growing trend among ransomware operators to enhance their evasion capabilities by systematically disabling security defenses, thereby increasing the success rate of their attacks. Organizations must remain vigilant and adopt comprehensive security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Kali365: The Emerging Threat Bypassing MFA in Microsoft 365
Financial Services4 months ago

Kali365: The Emerging Threat Bypassing MFA in Microsoft 365

In April 2026, a new Phishing-as-a-Service (PhaaS) platform named Kali365 emerged, enabling cybercriminals to hijack Microsoft 365 accounts by exploiting the OAuth device code flow. This method allows attackers to bypass multi-factor authentication (MFA) by tricking users into entering device codes on legitimate Microsoft verification pages, thereby granting unauthorized access to services like Outlook, OneDrive, and Teams. The FBI issued a public service announcement in May 2026, highlighting the widespread distribution of Kali365 via Telegram and its use in numerous attacks across various sectors, including manufacturing, education, government, financial services, and healthcare. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai)) The significance of this incident lies in its demonstration of how attackers can circumvent traditional security measures, such as MFA, by exploiting legitimate authentication processes. The accessibility of Kali365 through subscription services lowers the barrier for less-skilled attackers to conduct sophisticated phishing campaigns, posing a substantial threat to organizations relying on Microsoft 365. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports