Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 13 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 145–156 / 3490 reports
One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack
One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack
Information Technology/IT2 weeks ago

One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack

In October 2024, an unidentified threat actor exploited a compromised multi-tenant API secret tied to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to Microsoft 365 environments across hundreds of customer tenants. The attacker leveraged the stolen credential to bypass MFA, perform Microsoft Graph API reconnaissance, elevate privileges, and implant persistent backdoor credentials in affected tenants. Huntress confirmed successful sign-ins across more than 300 Entra tenants, with 162 verified compromises. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services roughly two days after initial attack activity was observed on October 15, 2024. This incident exemplifies the systemic risk of shared multi-tenant application secrets in managed service provider ecosystems. A single compromised credential cascaded into hundreds of downstream customer breaches, underscoring how supply-chain trust relationships and privileged API access can become force-multipliers for attackers targeting SMB-focused MSP platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks
php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks
Information Technology/IT2 weeks ago

php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks

In October 2026, the PHP project issued an emergency out-of-band patch release to address two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell' by researchers. Both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5 onward, placing an estimated 1.3–1.9 million internet-exposed hosts at risk. Exploit code and a proof-of-concept video leaked online before the official advisory, prompting Cloudflare to detect early in-the-wild attacks and deploy emergency firewall rules across its entire customer base. Patches were shipped as versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The php2shell disclosure highlights the compounding risk posed by PHP's enormous installed base—powering 70–80% of known server-side web infrastructure including WordPress, Drupal, and Laravel—combined with the reality that the majority of exposed hosts run end-of-life branches ineligible for official patches. Pre-patch exploit leakage, rapid weaponization, and confirmed early attacks reflect an accelerating trend in which vulnerability disclosure timelines collapse, leaving defenders minimal response windows.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet
eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet
Financial Services2 weeks ago

eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet

On October 17, 2026, a researcher identified as Wayne discovered that the private keys for eight eMudhra intermediate certificate authority (CA) certificates had been compromised, enabling any holder to issue fraudulently trusted TLS and code-signing certificates for any website or software. Chrome blocked the six TLS intermediates within 100 minutes of receiving the report; Firefox followed within hours via OneCRL. Because no rogue certificates appeared in Certificate Transparency logs, no active exploitation was confirmed, but the supply-chain risk was severe. Emergency patches were released across Go, Firefox, NSS, Python certifi, Rust webpki-roots, and Homebrew. Mozilla subsequently removed the eMudhra root from NSS, and Chrome began reviewing removal of eMudhra's remaining root. This incident highlights the systemic fragility of the public key infrastructure (PKI) supply chain: a single CA key compromise can cascade across every browser, runtime, and application that trusts that root. With intermediate CA keys exposed and revocation mechanisms unreliable across non-browser runtimes, organizations relying on TLS for encrypted traffic validation face silent trust failures—directly amplifying risks of undetected data exfiltration and adversary-in-the-middle attacks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Two Critical PHP RCE Zero-Days Leaked Before Patches: What Cloud Security Teams Must Do Now
Two Critical PHP RCE Zero-Days Leaked Before Patches: What Cloud Security Teams Must Do Now
Internet2 weeks ago

Two Critical PHP RCE Zero-Days Leaked Before Patches: What Cloud Security Teams Must Do Now

On October 20, 2026, the PHP security team issued an emergency advisory warning administrators of two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619—each scored 9.2 under CVSS v4.0, with independent researchers at watchTowr citing CVSS 10.0. Both flaws affect PHP versions 5 through 8, covering the vast majority of the web's server-side scripting infrastructure. Details leaked ahead of the planned embargo, accelerating the disclosure timeline and raising the risk of imminent exploitation. Emergency patches were scheduled for October 21, 2026 at 14:00 UTC. The incident underscores how pre-patch information leakage dramatically compresses the window between discovery and active exploitation. This incident reflects a growing pattern of embargo failures that leave organizations in a reactive posture before patches are available. With PHP powering an estimated 77% of websites with known server-side languages, unpatched RCE flaws at this severity represent systemic internet infrastructure risk. Security teams must treat pre-patch intelligence as an active threat signal and accelerate detection and segmentation controls before fixes are deployed.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Financial Services2 weeks ago

Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam

Since at least 2017, a Russian-language affiliate network called Hotejka has operated Help TDS, a malicious traffic distribution system that routes victims to Microsoft-impersonation tech support scams. Researchers at Infoblox infiltrated the affiliate panel and confirmed the platform serves over a dozen criminal affiliates—including known malware operations Balada Injector and DollyWay—redirecting compromised web traffic to fake Windows security alerts. Victims are socially engineered into installing remote desktop tools such as UltraViewer, granting threat actors persistent, repeated access to their systems. Over 20,000 malicious Cloudflare Pages domains were detected across a six-month period, with C2 infrastructure rolling over every five minutes via Telegram. This operation illustrates how commodity social engineering infrastructure has industrialized at scale, combining legitimate CDN abuse, dark-web affiliate models, and remote access tooling to enable long-term victim exploitation far beyond simple credit card fraud.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
ROMULUS ClickFix: How a New Malware Delivery Platform Is Turning Users Into Their Own Worst Enemy
ROMULUS ClickFix: How a New Malware Delivery Platform Is Turning Users Into Their Own Worst Enemy
Information Technology/IT2 weeks ago

ROMULUS ClickFix: How a New Malware Delivery Platform Is Turning Users Into Their Own Worst Enemy

In October 2026, cybersecurity researchers at Forescout Vedere Labs disclosed ROMULUS, a multi-payload ClickFix delivery platform distributing malware including LegionLoader (also known as Satacom, CurlyGate, and RobotDropper). ROMULUS operates by luring victims to fraudulent landing pages that instruct them to execute malicious PowerShell commands, triggering a staged infection chain. The platform delivers either trojanized MSI installers or encrypted, padded archives exceeding 1 GB designed to evade sandbox analysis. Six active IP addresses were identified, one linked to a prior campaign abusing ChatGPT Custom GPTs. The attributed operators remain unknown, though ROMULUS shares no overlap with China-aligned Silver Fox threat actor infrastructure. ROMULUS signals a significant evolution in ClickFix from a standalone social engineering trick into a scalable, commoditized malware-as-a-service delivery framework. The use of padded payloads to defeat sandboxes, multi-stage PowerShell loaders, and potential affiliate or commercial panel structures mirrors the professionalization trend seen in ransomware ecosystems, raising the risk profile for enterprises across all sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk
CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk
Health Care / Life Sciences2 weeks ago

CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk

In October 2026, CISA published ICS Medical Advisory ICSMA-26-288-01 disclosing a path traversal vulnerability (CVE-2026-107777, CWE-22) in Thermo Fisher Scientific's Torrent Suite Software versions 5.18 and earlier, a genomic sequencing platform widely deployed in healthcare and public health environments worldwide. An authenticated remote attacker can exploit the flaw by sending a crafted HTTP request that escapes the application's restricted directory, allowing arbitrary file reads on the underlying Torrent Server under the privileges of the web service account. Scored CVSS 3.1 at 6.5 (Medium) and CVSS 4.0 at 7.1 (High), the vulnerability exposes sensitive genomic, patient, and configuration data without requiring user interaction or elevated credentials beyond basic authentication. Thermo Fisher resolved the issue in Torrent Suite Software version 5.22. Path traversal flaws in medical and ICS devices continue to be a primary vector for healthcare data breaches, with CISA and HHS reporting a sustained increase in targeted exploitation of unpatched clinical informatics platforms. The convergence of genomic research infrastructure with internet-accessible deployment architectures elevates the risk profile well beyond traditional IT vulnerabilities, making timely patching and network segmentation operationally critical.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records
Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records
Health Care / Life Sciences2 weeks ago

Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records

On October 15, 2026, CISA issued ICS-Medical Advisory ICSMA-26-288-02 disclosing six critical and high-severity vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, a widely deployed open-source clinical image archive used globally across healthcare and public health infrastructure. The flaws span missing authentication on DICOM and HL7 interfaces (CVE-2026-105279, CVE-2026-105667), missing authorization on storage management REST APIs (CVE-2026-97851), and denial-of-service conditions via malformed JPEG, MP4, and multipart inputs (CVE-2026-107621, CVE-2026-105273, CVE-2026-101021). Unauthenticated remote attackers can enumerate and exfiltrate patient records and medical images, inject forged diagnostic studies, permanently reassign patient identities across the archive, and trigger service outages—all without credentials, over the network, at CVSS scores reaching 9.3. These vulnerabilities illustrate a persistent and dangerous pattern in healthcare ICS environments: medical imaging systems exposed on internal clinical networks frequently lack authentication on legacy DICOM and HL7 interfaces, creating zero-barrier pathways for patient data exfiltration and record manipulation. With ransomware groups and nation-state actors increasingly targeting healthcare infrastructure, unpatched imaging archives represent a direct compliance liability under HIPAA and an operational risk to patient safety.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today
ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today
Information Technology/IT2 weeks ago

ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today

In October 2026, CISA issued an urgent advisory disclosing active exploitation of CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 and earlier. Threat actors tracked under the campaign identifier ARMORY CASTLE are leveraging this flaw to gain unauthenticated initial access to self-hosted Remote Support appliances, then establishing persistence, escalating privileges, and moving laterally across enterprise networks. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, and patch BT26-05-RS is available for supported versions. SaaS-hosted deployments were patched automatically, but on-premises environments remain at significant risk without immediate action. This incident underscores a persistent and accelerating pattern of threat actors targeting privileged remote-access and support infrastructure as a high-value initial access vector. As remote-access tooling becomes increasingly embedded in enterprise and government IT operations, unpatched appliances represent a critical exposure surface that adversaries are systematically scanning and exploiting within days of disclosure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
Information Technology/IT2 weeks ago

ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants

In October 2026, ConnectWise disclosed a supply-chain credential compromise in which threat actors exploited a vendor application credential to gain unauthorized access to application identities tied to its Cloud Backup service. First identified on October 14, the attackers used a single compromised vendor credential from IP 144.172.64.128 to perform application sign-ins across thousands of Microsoft 365 tenants. Post-compromise activity included self-granting Global Administrator rights and backdooring additional applications with new secrets for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, reset credentials, and engaged third-party incident responders. Huntress telemetry across 10,000-plus tenants confirmed the scope. This incident underscores the accelerating threat of supply-chain credential abuse targeting managed service providers. As attackers increasingly pivot through trusted vendor relationships to reach downstream customers at scale, the ConnectWise breach exemplifies why identity hygiene, least-privilege application permissions, and real-time cross-tenant visibility have become non-negotiable security controls for MSP ecosystems in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now
Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now
Transportation2 weeks ago

Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now

In October 2026, CISA published ICS Advisory ICSA-26-293-01 disclosing six memory-safety vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers (versions ≤5.1.2 / ≤5.1.2.1151). The flaws—spanning out-of-bounds writes, classic buffer overflows, improper array-index validation, untrusted pointer dereference, and length-parameter inconsistency—allow a local, low-privileged user to crash the Windows kernel, causing denial-of-service conditions on workstations and engineering stations running CAN-bus hardware. Affected sectors include Transportation, Healthcare, Energy, and Critical Manufacturing globally. HMS Networks released a fix in version 5.1.4 and recommends immediate upgrade. Kernel-level driver vulnerabilities in OT/ICS environments are an accelerating trend: attackers increasingly target device drivers as a reliable path to system instability or privilege escalation on engineering workstations that are difficult to patch quickly. With six CVEs simultaneously disclosed across widely deployed industrial CAN-bus drivers, organizations should treat driver patch management as a first-class control within their ICS security programs.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor
Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor
Health Care / Life Sciences2 weeks ago

Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor

In mid-2026, ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) began actively exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access, to establish unauthorized VPN sessions and circumvent multi-factor authentication controls. After gaining an initial foothold, attackers conducted internal reconnaissance using dual-use RMM tools, moved laterally via RDP and SMB, harvested credentials by targeting vCenter and ESXi hypervisors at the virtualization layer, and deployed ransomware alongside data-exfiltration tooling across sectors including healthcare, financial services, government, and education. Veeam backup infrastructure was also targeted using CVE-2023-27532 to maximize damage and eliminate recovery options. This campaign underscores an accelerating trend of ransomware operators chaining perimeter authentication bypasses with deep virtualization-layer attacks to defeat endpoint detection, MFA, and backup resilience simultaneously. As CISA KEV listings shorten the window between disclosure and exploitation, organizations relying on gateway-centric security without east-west segmentation and encrypted-traffic visibility face compounding risk.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports