Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 134 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1597–1608 / 3490 reports
TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

TeamPCP's Compromise of Checkmarx Jenkins Plugin: A 2026 Supply Chain Attack

In May 2026, the threat group TeamPCP compromised Checkmarx's Jenkins AST plugin by publishing a backdoored version (2026.5.09) to the Jenkins Marketplace. This malicious plugin, assigned CVE-2026-33634 with a CVSS score of 9.4, allowed attackers to execute code within CI/CD pipelines, potentially exposing sensitive credentials and source code. The incident follows previous attacks by TeamPCP on Checkmarx's KICS tool and the Trivy vulnerability scanner, indicating a targeted campaign against developer tools. ([thehackernews.com](https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting CI/CD environments. Organizations must enhance their security measures by verifying the integrity of third-party plugins and implementing robust monitoring to detect unauthorized changes within their development pipelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation
Financial Services5 months ago

Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation

In May 2026, Microsoft disrupted Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) platform. Fox Tempest exploited Microsoft's Artifact Signing to generate over a thousand fraudulent code-signing certificates, enabling other cybercriminals to distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, under the guise of legitimate software. This operation facilitated attacks across various sectors globally, including healthcare, education, government, and financial services. The takedown involved revoking the fraudulent certificates and dismantling the infrastructure supporting Fox Tempest's operations. The incident underscores the evolving tactics of cybercriminals who abuse legitimate services to enhance the credibility of their malware, thereby evading traditional security measures. It highlights the critical need for organizations to implement robust security controls, including advanced threat detection and response capabilities, to mitigate the risks posed by such sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime
Financial Services5 months ago

Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime

In May 2026, Microsoft, through its Digital Crimes Unit, successfully dismantled the infrastructure of Fox Tempest, a cybercrime service that produced and sold over 1,000 fraudulent code-signing certificates. These certificates were utilized by various ransomware groups, including Rhysida and Vanilla Tempest, to make malicious software appear legitimate, thereby bypassing security defenses. The operation involved seizing domain names, websites, and Azure resources linked to Fox Tempest, effectively disrupting their malware-signing-as-a-service operations. ([axios.com](https://www.axios.com/2026/05/19/microsoft-fox-tempest-law-enforcement-takedown?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, moving upstream to exploit software verification systems. The ability to fabricate trusted certificates at scale poses a substantial threat to global cybersecurity, emphasizing the need for enhanced vigilance and robust verification processes within software supply chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities
Computer Software/Engineering5 months ago

Pwn2Own Berlin 2026: Unveiling 47 Zero-Day Vulnerabilities

The Pwn2Own Berlin 2026 hacking contest, held from May 14 to May 16, 2026, at the OffensiveCon conference, concluded with security researchers earning $1,298,250 in rewards after successfully exploiting 47 zero-day vulnerabilities. The competition focused on enterprise technologies and artificial intelligence, targeting fully patched products across various categories, including web browsers, enterprise applications, servers, and virtualization platforms. Notably, the DEVCORE Research Team secured the highest reward of $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. This event underscores the persistent challenges in securing enterprise software and the critical importance of proactive vulnerability management. The exposure of these zero-day vulnerabilities highlights the need for organizations to stay vigilant and prioritize timely patching to mitigate potential exploitation risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Clop Ransomware Targets Cloud Clearway Group in March 2026 Attack
Financial Services5 months ago

Clop Ransomware Targets Cloud Clearway Group in March 2026 Attack

In March 2026, the Clop ransomware group executed a cyberattack on Cloud Clearway Group, a leading IT services firm in Canada. The attackers encrypted sensitive data and threatened to release it unless their ransom demands were met. This incident underscores the persistent threat posed by Clop, which has been responsible for numerous high-profile attacks targeting various sectors globally. The attack on Cloud Clearway Group highlights the evolving tactics of ransomware groups, emphasizing the need for organizations to bolster their cybersecurity defenses. With ransomware attacks becoming more sophisticated and frequent, businesses must prioritize proactive measures to mitigate potential risks and ensure data security.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Malicious npm Packages Deliver Infostealers and DDoS Malware
Computer Software/Engineering5 months ago

Malicious npm Packages Deliver Infostealers and DDoS Malware

In May 2026, cybersecurity researchers identified four malicious npm packages—chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils—containing infostealer malware and DDoS botnet functionality. These packages, published by the user deadcode09284814, were designed to steal sensitive information and facilitate distributed denial-of-service attacks. Notably, one package was a clone of the Shai-Hulud worm, previously leaked by TeamPCP. This incident underscores the escalating threat of supply chain attacks targeting developers through trusted repositories like npm. The discovery highlights the critical need for developers to exercise caution when integrating third-party packages, as attackers increasingly exploit public repositories to distribute malware. Implementing robust security measures, such as verifying package authenticity and monitoring for suspicious activity, is essential to mitigate the risks associated with supply chain compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
MiniPlasma Zero-Day: A Critical Threat to Windows 11 Security
Financial Services5 months ago

MiniPlasma Zero-Day: A Critical Threat to Windows 11 Security

In May 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Windows, codenamed MiniPlasma. This flaw affects the Windows Cloud Files Mini Filter Driver (cldflt.sys) and allows attackers to escalate privileges to SYSTEM level on fully patched Windows 11 systems. The vulnerability was initially reported to Microsoft in September 2020 and was believed to have been patched in December 2020 as CVE-2020-17103. However, recent findings indicate that the issue remains unpatched, posing significant security risks. The public release of the MiniPlasma exploit underscores ongoing challenges in Windows security, particularly concerning privilege escalation vulnerabilities. Organizations must reassess their security postures and implement additional measures to mitigate the risks associated with this unpatched flaw.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Ivanti Xtraction (CVE-2026-8043) Poses Severe Risks
Information Technology/IT5 months ago

Critical Vulnerability in Ivanti Xtraction (CVE-2026-8043) Poses Severe Risks

In May 2026, Ivanti disclosed a critical vulnerability (CVE-2026-8043) in its Xtraction platform, which allows authenticated remote attackers to bypass directory restrictions. This flaw enables unauthorized access to sensitive internal system files and permits writing arbitrary HTML files to web directories, potentially transforming trusted servers into malicious hosts for client-side attacks. The vulnerability carries a CVSS score of 9.6, indicating its severity. The healthcare sector is particularly at risk due to the sensitive nature of Protected Health Information (PHI) managed by Xtraction. Organizations are urged to upgrade to version 2026.2 immediately to mitigate potential data exposure and client-side attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit
Information Technology/IT5 months ago

Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit

In May 2026, a series of significant cybersecurity incidents underscored the vulnerabilities in widely used systems and software. A zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange Server was actively exploited, allowing attackers to execute arbitrary JavaScript via crafted emails, affecting on-premises deployments. Concurrently, the 'Mini Shai-Hulud' campaign compromised multiple npm packages, including those from TanStack and Mistral AI, embedding malicious code to steal credentials and potentially execute destructive actions. Additionally, a critical authentication bypass flaw (CVE-2026-20182) in Cisco Catalyst SD-WAN Controllers was exploited by threat actor UAT-8616 to gain unauthorized access and escalate privileges. These incidents highlight the escalating sophistication of supply chain attacks and the critical need for robust security measures across all software dependencies. Organizations must prioritize patching known vulnerabilities, implement stringent access controls, and continuously monitor for anomalous activities to mitigate the risks posed by such multifaceted threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security
Computer Software/Engineering5 months ago

Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security

Between April 29 and May 1, 2026, a coordinated supply chain attack known as "Mini Shai-Hulud" targeted multiple developer ecosystems, including npm, PyPI, and Docker Hub. The threat actor group TeamPCP injected malicious code into widely used packages such as SAP's Cloud Application Programming Model, PyTorch Lightning, and Intercom's npm package. This malware harvested sensitive credentials from developer environments and CI/CD pipelines, including GitHub tokens, cloud API keys, and SSH keys, by exfiltrating them to attacker-controlled repositories. The attack compromised over 170 packages, affecting millions of developers and organizations worldwide. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-supply-chain-20260503-csa/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, which now focus on developer workstations as entry points. The integration of malicious code into trusted packages highlights the need for enhanced security measures in the software development lifecycle, particularly in dependency management and CI/CD processes. Organizations must adopt comprehensive strategies to protect against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
YellowKey Exploit: A Critical Threat to BitLocker Encryption on Windows 11
Government Administration5 months ago

YellowKey Exploit: A Critical Threat to BitLocker Encryption on Windows 11

In May 2026, a security researcher known as Nightmare-Eclipse disclosed a critical vulnerability named YellowKey, which allows attackers with physical access to bypass BitLocker encryption on Windows 11 systems. By exploiting the Windows Recovery Environment (WinRE), an attacker can use a specially crafted USB stick to gain full access to encrypted drives without requiring the user's password. This vulnerability affects default deployments of BitLocker, posing significant risks to data security. The disclosure of YellowKey underscores the ongoing challenges in securing physical access points and highlights the need for robust encryption practices. Organizations relying on BitLocker for data protection must reassess their security measures to mitigate potential exploitation of this vulnerability.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Instructure Canvas Breach 2026: A Wake-Up Call for SaaS Security
Higher Education/Acadamia5 months ago

Instructure Canvas Breach 2026: A Wake-Up Call for SaaS Security

In early May 2026, Instructure's Canvas learning management system suffered two significant breaches within a week, orchestrated by the cybercriminal group ShinyHunters. The attackers exploited vulnerabilities in the 'Free-For-Teacher' accounts to gain unauthorized access, leading to the exfiltration of 3.65 terabytes of data from approximately 275 million users across nearly 9,000 institutions. The compromised data included names, email addresses, student ID numbers, and private messages. Following the breaches, ShinyHunters defaced Canvas login pages and demanded a ransom, which Instructure paid in exchange for assurances that the stolen data would be destroyed and not used for further extortion. ([techcrunch.com](https://techcrunch.com/2026/05/12/instructure-strikes-deal-with-hackers-who-breached-it-twice/?utm_source=openai)) This incident underscores the escalating threat landscape targeting educational platforms and the critical need for robust identity governance and data protection measures. The breaches highlight the vulnerabilities inherent in widely adopted SaaS platforms and the potential for significant operational disruptions and data privacy concerns when such systems are compromised.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports