Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 127 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1513–1524 / 3490 reports
Gitea Vulnerability CVE-2026-27771: Unauthenticated Access to Private Container Images
Computer Software/Engineering5 months ago

Gitea Vulnerability CVE-2026-27771: Unauthenticated Access to Private Container Images

In May 2026, a critical vulnerability (CVE-2026-27771) was discovered in Gitea, an open-source version control platform, allowing unauthenticated remote attackers to access private container images without credentials. This flaw, present in all versions prior to 1.26.2, potentially exposed over 30,000 deployments across more than 30 countries, affecting sectors such as healthcare, aerospace, retail, and internet services. The vulnerability had remained undetected for nearly four years. The incident underscores the importance of regular security audits and prompt patch management in open-source software. Organizations are advised to update to Gitea version 1.26.2 or later to mitigate this risk. This case highlights the ongoing challenges in securing software supply chains and the necessity for vigilance in protecting sensitive data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
CVE-2026-9082: Critical SQL Injection Vulnerability in Drupal Core
Higher Education/Acadamia5 months ago

CVE-2026-9082: Critical SQL Injection Vulnerability in Drupal Core

In May 2026, a critical SQL injection vulnerability, CVE-2026-9082, was identified in Drupal Core's database abstraction API, specifically affecting deployments using PostgreSQL. This flaw allows unauthenticated attackers to execute arbitrary SQL queries by sending specially crafted requests, potentially leading to full database compromise or remote code execution. The vulnerability impacts Drupal versions from 8.9.0 up to 11.3.9. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) The urgency of this issue is underscored by the fact that it can be exploited anonymously, posing a significant risk to internet-facing Drupal sites using PostgreSQL. Organizations are advised to promptly upgrade to the patched versions and implement monitoring controls to detect SQL injection attempts. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CrowdStrike's Strategic Takedown of the Glassworm Botnet
Computer Software/Engineering5 months ago

CrowdStrike's Strategic Takedown of the Glassworm Botnet

In May 2026, CrowdStrike, in collaboration with Google and the Shadowserver Foundation, successfully dismantled the Glassworm botnet, a sophisticated operation targeting software developers through the open-source supply chain. Since early 2025, Glassworm had infiltrated numerous systems by compromising VSCode extensions, npm and Python packages, and over 300 GitHub repositories, leading to widespread data and credential theft across Windows, macOS, and Linux platforms. The botnet's resilience was attributed to its use of multiple command-and-control channels, including the Solana blockchain, BitTorrent's peer-to-peer network, Google Calendar, and virtual private servers. The coordinated takedown severed these channels, effectively neutralizing the botnet's operations. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/?utm_source=openai)) This incident underscores the escalating threat posed by supply chain attacks, particularly those targeting developer environments. The Glassworm case highlights the necessity for organizations to implement robust security measures within their development pipelines and to remain vigilant against increasingly sophisticated attack vectors that exploit trusted software ecosystems. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
May 2026 Cyber Threats: ClearFake Campaign and GraphRunner Malware
Financial Services5 months ago

May 2026 Cyber Threats: ClearFake Campaign and GraphRunner Malware

In May 2026, multiple sophisticated cyber threats emerged, notably the ClearFake campaign, which utilized advanced web injection techniques to deploy the Amatera Stealer malware. This malware, an evolution of the ACR Stealer, was distributed through deceptive methods such as EtherHiding and ClickFix, leading to significant data exfiltration. Additionally, the GraphRunner malware debuted, exploiting vulnerabilities in cloud services to execute unauthorized code, posing substantial risks to cloud infrastructure security. These incidents underscore a concerning trend: cybercriminals are increasingly leveraging complex, multi-stage attacks that combine social engineering with technical exploits. The rise of such sophisticated malware campaigns highlights the urgent need for organizations to enhance their cybersecurity measures and remain vigilant against evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Shai-Hulud 2.0: Unveiling the 2025 npm Supply Chain Attack
Computer Software/Engineering5 months ago

Shai-Hulud 2.0: Unveiling the 2025 npm Supply Chain Attack

In November 2025, the Shai-Hulud 2.0 supply chain attack emerged as a significant threat to the npm ecosystem. Attackers compromised hundreds of npm packages by injecting malicious preinstall scripts that executed before installation completion. These scripts harvested sensitive data, including credentials and configuration secrets, from developer environments and CI/CD pipelines, exfiltrating them to attacker-controlled repositories. The malware exhibited worm-like behavior, autonomously spreading by publishing malicious versions of accessible packages, thereby propagating across the npm ecosystem. Major projects such as Zapier, Ethereum Name Service (ENS), PostHog, and Postman were affected, with over 25,000 repositories compromised within a few hours. ([blog.checkpoint.com](https://blog.checkpoint.com/research/shai-hulud-2-0-inside-the-second-coming-the-most-aggressive-npm-supply-chain-attack-of-2025/?utm_source=openai)) This incident underscores the escalating sophistication of supply chain attacks targeting open-source ecosystems. The rapid propagation and automation observed in Shai-Hulud 2.0 highlight the urgent need for enhanced security measures in software development pipelines. Organizations must prioritize securing their development environments, implement robust monitoring, and adopt best practices to mitigate the risks associated with such pervasive threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in ABB Ability™ zenon: CVE-2025-8754
Oil/Energy/Solar/Greentech5 months ago

Critical Vulnerability in ABB Ability™ zenon: CVE-2025-8754

In August 2025, a critical vulnerability (CVE-2025-8754) was identified in ABB's Ability™ zenon software, versions 7.50 through 14. This flaw allows unauthenticated remote attackers to access critical functions, potentially leading to denial-of-service conditions in industrial control environments. The vulnerability arises from missing authentication mechanisms in the Remote Transport Service, enabling unauthorized system reboots. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2025-8754&utm_source=openai)) The incident underscores the importance of robust authentication protocols in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely vulnerability assessments and implement comprehensive security measures to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
CERT-In's 12-Hour Patching Mandate: A Response to AI-Driven Cyber Threats
Financial Services5 months ago

CERT-In's 12-Hour Patching Mandate: A Response to AI-Driven Cyber Threats

In May 2026, the Indian Computer Emergency Response Team (CERT-In) issued new guidelines requiring organizations to patch critical security vulnerabilities in internet-exposed systems within 12 hours of identification. This directive aims to mitigate threats from adversaries leveraging artificial intelligence (AI) tools and large language models (LLMs) to automate vulnerability discovery and exploitation, thereby accelerating the scale and speed of cyber attacks. CERT-In emphasized that AI-assisted cyber exploitation reduces the time required for adversaries to identify, weaponize, and exploit vulnerabilities, exposed services, weak identities, insecure APIs, and misconfigured systems. As organizations become increasingly dependent on interconnected digital infrastructure, cloud ecosystems, software supply chains, operational technologies, and AI-enabled platforms, the potential impact of AI-enabled cyber threats continues to increase across sectors. ([thehackernews.com](https://thehackernews.com/2026/05/cert-in-mandates-12-hour-patching-for.html?utm_source=openai)) This development underscores the evolving cyber threat landscape, where AI technologies are being harnessed to compress attack timelines and bypass traditional security controls. Organizations are urged to adopt proactive cybersecurity measures, including continuous threat assessment, proactive exposure reduction, and operational preparedness, to effectively counter these AI-assisted threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding and Mitigating MFA Prompt Bombing Attacks in 2026
Financial Services5 months ago

Understanding and Mitigating MFA Prompt Bombing Attacks in 2026

In May 2026, a significant cybersecurity threat emerged involving Multi-Factor Authentication (MFA) prompt bombing attacks. Cybercriminals exploited push-based MFA systems by repeatedly sending authentication requests to users, aiming to induce fatigue and prompt them to approve unauthorized access. This method effectively bypassed traditional MFA protections, leading to unauthorized access to sensitive systems and data. The attacks primarily targeted organizations utilizing push-based MFA for services like Microsoft 365, VPNs, and other cloud applications, resulting in compromised accounts and potential data breaches. The prevalence of MFA prompt bombing underscores the evolving tactics of threat actors who leverage social engineering to circumvent security measures. This trend highlights the necessity for organizations to adopt more resilient authentication methods, such as number-matching codes or hardware tokens, and to implement comprehensive user education programs to recognize and resist such attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659
Financial Services5 months ago

Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659

In May 2026, Microsoft addressed a critical remote code execution vulnerability, CVE-2026-45659, in SharePoint Server versions 2016, 2019, and Subscription Edition. This flaw arises from the deserialization of untrusted data, allowing authenticated attackers with minimal permissions to execute arbitrary code remotely without user interaction. The vulnerability has a CVSS score of 8.8, indicating high severity. ([thehackernews.com](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html?utm_source=openai)) The prompt release of patches underscores the importance of timely updates, especially given SharePoint's role in storing sensitive corporate data. Organizations are urged to apply these updates promptly to mitigate potential exploitation risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cybercriminals Exploit Claude AI Popularity to Distribute Malware
Computer Software/Engineering5 months ago

Cybercriminals Exploit Claude AI Popularity to Distribute Malware

In early 2026, cybercriminals launched a sophisticated campaign targeting users seeking to download Anthropic's Claude AI tool. By creating fraudulent websites that closely mimicked the official Claude download pages, attackers distributed trojanized installers. These malicious installers appeared legitimate but secretly deployed malware, such as PlugX and ACR Stealer, granting attackers remote access to victims' systems and enabling the theft of sensitive information, including credentials and financial data. The campaign exploited users' trust in search engine results and official-looking websites, leading to widespread infections across both Windows and macOS platforms. This incident underscores a growing trend where threat actors leverage the popularity of AI tools to execute social engineering attacks. The use of fake installation guides and malicious advertisements highlights the need for heightened vigilance among users and organizations. As AI tools become more integrated into daily operations, ensuring the authenticity of download sources and implementing robust cybersecurity measures are imperative to prevent similar attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic's Claude Mythos: Revolutionizing Cybersecurity with AI
Computer Software/Engineering5 months ago

Anthropic's Claude Mythos: Revolutionizing Cybersecurity with AI

In April 2026, Anthropic introduced 'Claude Mythos,' an advanced AI model with exceptional capabilities in identifying and exploiting software vulnerabilities. The model demonstrated the ability to autonomously develop sophisticated cyberattacks, raising significant concerns about its potential misuse. To mitigate these risks, Anthropic restricted public access to Mythos, collaborating with select partners through Project Glasswing to enhance cybersecurity defenses. ([euronews.com](https://www.euronews.com/next/2026/04/08/why-anthropics-most-powerful-ai-model-mythos-preview-is-too-dangerous-for-public-release?utm_source=openai)) The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where AI can both uncover and exploit vulnerabilities at unprecedented speeds. This development underscores the urgent need for robust security measures and proactive strategies to address the dual-use nature of such technologies. ([cfr.org](https://www.cfr.org/articles/six-reasons-claude-mythos-is-an-inflection-point-for-ai-and-global-security?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
FBI Issues Warning on Kali365 Phishing Service Exploiting Microsoft 365 Accounts
Financial Services5 months ago

FBI Issues Warning on Kali365 Phishing Service Exploiting Microsoft 365 Accounts

In April 2026, the FBI identified 'Kali365,' a Phishing-as-a-Service (PhaaS) platform distributed via Telegram, enabling cybercriminals to hijack Microsoft 365 accounts. By exploiting Microsoft's OAuth 2.0 Device Authorization grant flow, attackers trick users into entering device codes on legitimate Microsoft pages, granting unauthorized access to services like Outlook, Teams, and OneDrive. This method bypasses multi-factor authentication (MFA) and does not require stealing user credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/?utm_source=openai)) The emergence of Kali365 underscores a significant shift in cyber threats, where sophisticated phishing tools are now accessible to less-skilled attackers. This trend highlights the urgent need for organizations to reassess and strengthen their authentication protocols and user education to mitigate evolving phishing tactics. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports