Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 120 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1429–1440 / 3490 reports
IronWorm and Miasma Worm Supply Chain Attacks on npm - June 2026
Computer Software/Engineering5 months ago

IronWorm and Miasma Worm Supply Chain Attacks on npm - June 2026

In early June 2026, the npm ecosystem faced significant supply chain attacks involving the IronWorm and a new variant of the Miasma worm. Threat actors compromised over 50 legitimate npm packages to distribute a Rust-based information stealer and a self-propagating worm. The IronWorm malware, concealed by an eBPF kernel rootkit, harvested sensitive data from developers' machines and propagated by injecting malicious code into GitHub repositories. Concurrently, the Miasma worm variant targeted 57 npm packages, deploying credential-stealing payloads that executed during package installation, compromising cloud credentials and CI/CD secrets. These attacks underscore the escalating threats to software supply chains, emphasizing the need for robust security measures in package management and development workflows. The rapid propagation and sophisticated techniques employed highlight the urgency for organizations to enhance their defenses against such evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gartner Highlights Four Critical Cybersecurity Threats for 2026
Financial Services5 months ago

Gartner Highlights Four Critical Cybersecurity Threats for 2026

In June 2026, Gartner analysts highlighted four critical cybersecurity threats where attackers currently have the upper hand: deepfakes, software supply chain risks, prompt injections, and AI application compromises. These threats exploit vulnerabilities in enterprise defenses, leading to significant security breaches and operational disruptions. Organizations are urged to enhance their security postures by implementing additional controls and stronger policies to mitigate these emerging risks. The urgency to address these threats is underscored by the rapid evolution of attack techniques and the increasing sophistication of threat actors. Enterprises must proactively adapt their security strategies to counteract these advanced threats and protect their assets effectively.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
IronWorm Malware: A 2026 npm Supply Chain Attack
Computer Software/Engineering5 months ago

IronWorm Malware: A 2026 npm Supply Chain Attack

In June 2026, a sophisticated supply chain attack named 'IronWorm' targeted the npm ecosystem, compromising 36 packages with over 32,000 combined monthly downloads. The Rust-written malware infiltrated developers' environments through malicious npm package updates, harvesting sensitive credentials such as API keys, cloud credentials, SSH keys, and npm publishing tokens. Utilizing a rootkit that exploits the Linux kernel's eBPF, IronWorm concealed its activities and communicated with command-and-control servers via the Tor network, enabling it to propagate further across the software supply chain. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rust-written-ironworm-npm-supply-chain?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The use of advanced techniques like eBPF rootkits and Tor-based communications highlights the increasing sophistication of threat actors. Organizations must enhance their security measures to protect development environments and prevent the infiltration of malicious code into trusted software projects. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rust-written-ironworm-npm-supply-chain?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Adaptive, Agentic AI Worms: A New Era of Cyber Threats
Computer Software/Engineering5 months ago

Adaptive, Agentic AI Worms: A New Era of Cyber Threats

In June 2026, researchers from the University of Toronto, the Vector Institute, and the University of Cambridge developed a proof-of-concept AI-driven worm capable of autonomously analyzing and exploiting vulnerabilities across diverse systems. Unlike traditional worms that rely on predefined exploits, this AI worm utilizes open-weight large language models to adapt its attack strategies in real-time, enabling it to propagate through networks by identifying and leveraging unpatched vulnerabilities and misconfigurations. The worm demonstrated the ability to compromise a simulated enterprise network spanning Linux, Windows, and IoT devices, highlighting a significant evolution in malware capabilities. ([arxiv.org](https://arxiv.org/abs/2606.03811?utm_source=openai)) This development underscores the urgent need for organizations to enhance their cybersecurity defenses against adaptive, AI-powered threats. The emergence of such autonomous malware presents a destabilizing economic asymmetry between attackers and defenders, as the worm's propagation incurs minimal cost to the attacker while posing substantial risks to enterprise networks. ([arxiv.org](https://arxiv.org/abs/2606.03811?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PCPJack's Covert SMTP Relay Network: A Wake-Up Call for Cloud Security
Information Technology/IT5 months ago

PCPJack's Covert SMTP Relay Network: A Wake-Up Call for Cloud Security

In May 2026, the threat actor known as PCPJack hijacked 230 cloud servers across Amazon Web Services (AWS), Google Cloud, and Microsoft Azure to establish a covert SMTP email relay network. The compromised servers, located in the U.S., Europe, and Asia, were transformed into SMTP proxies, verified for mail relay capabilities, and synchronized to a downstream consumer every five minutes. This operation enabled the threat actor to send large volumes of emails while concealing their origin, potentially facilitating spam campaigns, phishing attacks, or other malicious activities. This incident underscores the increasing sophistication of cloud-based attacks and the critical need for robust security measures in cloud environments. Organizations must implement stringent access controls, regularly monitor for unauthorized activities, and ensure that all cloud services are properly configured to prevent exploitation by threat actors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft AI Red Team Enhances AI Security with Updated Failure Mode Taxonomy
Computer Software/Engineering5 months ago

Microsoft AI Red Team Enhances AI Security with Updated Failure Mode Taxonomy

In June 2026, the Microsoft AI Red Team released an updated taxonomy of failure modes in agentic AI systems, building upon their initial April 2025 publication. This revision introduces seven new failure mode categories, expands mitigation strategies, and incorporates insights from a year of red team engagements. Key developments prompting this update include the rapid mainstream adoption of open-source agentic frameworks like OpenClaw, which, upon its January 2026 launch, revealed significant vulnerabilities such as CVE-2026-25253—a critical WebSocket hijacking flaw. Additionally, the maturation of the Model Context Protocol (MCP) ecosystem has led to an increase in vulnerabilities, with 99 CVEs reported in 2025 alone. The transition of computer-use agents from research to production has further exposed novel attack surfaces, necessitating a comprehensive reevaluation of existing security frameworks. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/06/04/updating-taxonomy-failure-modes-agentic-ai-systems-year-red-teaming-taught-us/?utm_source=openai)) This update is particularly relevant as agentic AI systems become more integrated into critical domains, amplifying the potential impact of their failure modes. The introduction of new categories like Agentic Supply Chain Compromise and Goal Hijacking underscores the evolving threat landscape. Organizations must proactively adapt their security measures to address these emerging risks, ensuring the safe deployment and operation of agentic AI systems in increasingly complex environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
WeTransfer Phishing Campaign Delivers Multi-Stage Malware via Trusted Services
Financial Services5 months ago

WeTransfer Phishing Campaign Delivers Multi-Stage Malware via Trusted Services

In June 2026, a sophisticated phishing campaign was identified, leveraging legitimate WeTransfer links to distribute malicious JavaScript files. The attack began with an email containing a WeTransfer link to a file named "Remittance Advice.js," which, upon execution, initiated a multi-stage infection chain. This chain involved decoding and executing PowerShell commands to download and run additional payloads, including a modified .NET DLL disguised within an MSI-branded JPEG image. The attackers utilized trusted cloud services like Cloudflare Workers and R2 to host these malicious payloads, enhancing the campaign's credibility and evading detection mechanisms. This incident underscores the increasing trend of cybercriminals exploiting legitimate platforms to deliver malware, making it imperative for organizations to scrutinize even seemingly trustworthy sources. The use of steganography to conceal malicious code within image files further complicates detection efforts, highlighting the need for advanced threat detection capabilities and continuous monitoring of network traffic to identify and mitigate such sophisticated attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Active Exploitation of PAN-OS CVE-2026-0257
Computer/Network Security5 months ago

Active Exploitation of PAN-OS CVE-2026-0257

In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability, CVE-2026-0257, in its PAN-OS software affecting GlobalProtect portals and gateways. This flaw allows unauthenticated attackers to establish unauthorized VPN connections, potentially exposing internal networks to external threats. The vulnerability has been actively exploited in the wild, leading to its inclusion in CISA's Known Exploited Vulnerabilities catalog on May 29, 2026. Organizations are urged to review their systems for indicators of compromise and apply the recommended mitigations or updates promptly. The active exploitation of CVE-2026-0257 underscores the critical need for organizations to maintain up-to-date security patches and monitor for unauthorized access attempts. This incident highlights the evolving tactics of threat actors targeting network infrastructure vulnerabilities to gain unauthorized access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
OP-512: New Threat Cluster Targets Microsoft IIS Servers with Custom Web Shells
Government Administration5 months ago

OP-512: New Threat Cluster Targets Microsoft IIS Servers with Custom Web Shells

In June 2026, cybersecurity researchers identified a new threat cluster named OP-512, which targets Microsoft Internet Information Services (IIS) servers to deploy a custom web shell framework. This activity is assessed with moderate to high confidence to be linked to China and is focused on espionage. The attackers utilize a bespoke framework consisting of three web shells that provide remote access while evading detection through techniques like timestomping, which manipulates file timestamps to complicate forensic analysis. The compromised servers automatically report back to the attackers, facilitating centralized management at scale. This incident underscores a growing trend of sophisticated cyber-espionage campaigns targeting critical infrastructure. The use of custom web shells and advanced evasion techniques highlights the evolving tactics of nation-state actors, emphasizing the need for organizations to enhance their security measures to detect and mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Powered Worm Demonstrates Autonomous Cyber Threat Capabilities
Computer Software/Engineering5 months ago

AI-Powered Worm Demonstrates Autonomous Cyber Threat Capabilities

In June 2026, researchers at the University of Toronto unveiled a prototype AI-driven computer worm capable of autonomously analyzing and exploiting vulnerabilities across diverse network environments. Unlike traditional worms that rely on predefined exploits, this AI-powered worm utilizes an embedded large language model (LLM) to adapt its attack strategies in real-time, enabling it to compromise nearly 75% of a simulated corporate network within a week without human intervention. The worm operates by deploying its own LLM on infected machines, allowing it to reason about and exploit known vulnerabilities, misconfigurations, and common weaknesses as it propagates. This development marks a significant evolution in malware capabilities, demonstrating the potential for AI to enhance the adaptability and effectiveness of cyber threats. ([fortune.com](https://fortune.com/2026/06/03/a-new-ai-powered-computer-worm-could-prove-to-be-the-stuff-of-cybersecurity-nightmares/?utm_source=openai)) The emergence of AI-driven worms underscores the urgent need for advanced cybersecurity measures capable of countering adaptive and autonomous threats. As AI technologies become more accessible, the likelihood of their exploitation by malicious actors increases, posing significant risks to organizations worldwide. This incident serves as a critical reminder for businesses to invest in AI-aware security solutions and to continuously update their defense strategies to address the evolving threat landscape. ([scientificamerican.com](https://www.scientificamerican.com/article/scientists-just-built-a-powerful-ai-computer-worm-that-learns-as-it-spreads/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical SSRF Vulnerability in Cisco Unified CM: CVE-2026-20230
Telecommunications5 months ago

Critical SSRF Vulnerability in Cisco Unified CM: CVE-2026-20230

In June 2026, Cisco disclosed a critical server-side request forgery (SSRF) vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) and Unified CM Session Management Edition. This flaw allows unauthenticated remote attackers to send crafted HTTP requests, enabling them to write files to the underlying operating system and potentially escalate privileges to root. The vulnerability specifically affects systems with the WebDialer service enabled, which is disabled by default. Cisco has released security updates to address this issue and recommends administrators either apply the patches or disable the WebDialer service to mitigate the risk. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html?utm_source=openai)) The rapid public availability of proof-of-concept exploit code for CVE-2026-20230 underscores the urgency for organizations to address this vulnerability promptly. Given the critical nature of the flaw and the potential for privilege escalation, it is imperative for enterprises using Cisco Unified CM to assess their exposure and implement the recommended mitigations without delay. ([techtimes.com](https://www.techtimes.com/articles/317782/20260604/cisco-unified-cm-ssrf-flaw-cve-2026-20230-public-exploit-code-opens-path-root.htm?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DentaQuest Data Breach 2026: ShinyHunters Expose 2.6 Million Records
Health Care / Life Sciences5 months ago

DentaQuest Data Breach 2026: ShinyHunters Expose 2.6 Million Records

In May 2026, DentaQuest, a leading dental benefits administrator in the United States, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated DentaQuest's network, exfiltrating over 234 GB of sensitive data, which included personal information of approximately 2.6 million individuals. The compromised data encompassed email addresses, full names, phone numbers, government-issued IDs, health insurance details, genders, and dates of birth. Following unsuccessful ransom negotiations, ShinyHunters publicly released the stolen data, amplifying the potential for identity theft and fraud among affected individuals. This incident underscores a troubling trend of cyber extortion targeting healthcare organizations, highlighting the critical need for robust cybersecurity measures and rapid incident response protocols to protect sensitive patient information.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports