Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
In September 2026, attackers began actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 perimeter devices, enabling unauthenticated remote code execution. CVE-2026-83548, a critical SSRF vulnerability with a CVSS score of 10.0, allows unauthorized access through an unintended alternate access path, while CVE-2026-83549 enables OS command injection. When chained together, these flaws provide complete system compromise of affected appliances running versions 12.4.3-03453/12.5.0-02835 and older. SonicWall confirmed ongoing exploitation and urged immediate patching to versions 12.4.3-03526/12.5.0-02952 or higher. This incident highlights the continued targeting of edge security devices as initial compromise vectors, following a pattern of sophisticated zero-day attacks against network perimeter appliances throughout 2026, emphasizing the critical need for rapid patch management and network segmentation strategies.
2 weeks ago
Kill Chain
Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours
In September 2026, threat actors demonstrated the devastating potential of AI-assisted cyberattacks by compressing a typical two-week enterprise breach timeline into just 10 hours. The attackers deployed coordinated frontier AI agents that autonomously breached network security layers, harvested credentials, seized root access, hijacked CI/CD pipelines, and weaponized the victim's own AI infrastructure. The attack began with exploitation of a public API endpoint and escalated through systematic extraction of hardcoded tokens from code repositories, ultimately providing master administrative credentials and complete system compromise. This machine-speed ransomware attack represents a paradigm shift from individual AI-assisted tasks to orchestrated multi-agent operations that can outpace traditional security response capabilities. The emergence of AI-driven attack coordination signals a new era where threat actors can achieve enterprise-scale breaches with unprecedented speed and efficiency, forcing organizations to fundamentally reimagine their defense strategies and response timelines.
2 weeks ago
Kill Chain
Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026 after observing active exploitation by threat actors. The vulnerabilities span multiple platforms including SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, and AI infrastructure components like LiteLLM and Kestra. Attackers exploited these flaws to deploy reverse shells, cryptocurrency miners, and conduct unauthorized operations, with campaigns targeting AI infrastructure becoming increasingly prominent as adversaries seek to harvest API keys and monetize compromised systems. This incident highlights the growing threat landscape targeting AI infrastructure and the critical importance of rapid vulnerability remediation. With AI systems becoming prime targets for credential theft and resource hijacking, organizations must prioritize security updates and implement comprehensive monitoring across their AI workloads to prevent similar exploitation campaigns.
2 weeks ago
Kill Chain
FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector
In September 2026, security researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation exploit targeting CrowdStrike Falcon endpoint security software. The vulnerability abuses office malicious macros remediation functionality within Falcon Sensor to achieve privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 systems. This disclosure follows the researcher's pattern of releasing proof-of-concept exploits for major endpoint security products, including recent vulnerabilities in Kaspersky and Microsoft Defender, highlighting systemic weaknesses in endpoint protection platforms. This incident underscores the growing trend of security researchers targeting endpoint detection and response (EDR) solutions themselves, exposing critical trust assumptions in enterprise security architectures and forcing organizations to reconsider their defense-in-depth strategies.
2 weeks ago
Kill Chain
Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains
In August 2026, GitGuardian researchers discovered that the Shai-Hulud infostealer worm had evolved to scan for credentials across 469 locations in developer environments, representing a 148% increase from earlier variants that checked only 189 paths. The malware targets CI/CD tooling, cloud configurations, AI tool configs, package registries, and development environments to harvest reusable credentials for supply chain attacks. The stolen credentials enable lateral movement across trusted software supply chains, turning credential theft into ongoing propagation vectors through package publishing systems. This incident highlights the critical shift in attack methodologies where threat actors no longer need to break trust relationships but instead exploit existing credential sprawl across modern development ecosystems. The exponential increase in targeted credential locations demonstrates the growing sophistication of supply chain attacks and the urgent need for comprehensive secrets management across DevOps pipelines.
2 weeks ago
Kill Chain
Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access
Microsoft Threat Intelligence discovered a sophisticated social engineering campaign where threat actors impersonate IT support personnel through Microsoft Teams external collaboration to trick users into granting remote access. Once control is established via legitimate remote management tools, attackers deploy a malicious MSI package that stages a Node.js runtime and JavaScript implant for persistent command execution. The campaign progresses through extensive reconnaissance, Active Directory enumeration, and lateral movement via Windows Remote Management (WinRM) toward high-value assets including domain controllers, representing a precursor to ransomware deployment or data theft operations. This attack pattern demonstrates the evolving threat landscape where attackers leverage trusted enterprise collaboration platforms and legitimate administrative tools to bypass traditional security controls. The shift from commodity phishing to hands-on-keyboard operations targeting identity infrastructure reflects the increasing sophistication of modern threat actors seeking enterprise-wide access for high-impact cyberattacks.
2 weeks ago
Kill Chain
SANS Honeypot Captures Massive Automated Credential Attack Campaign
The SANS Internet Storm Center's Honeypot-Omaha deployment captured extensive automated credential attack campaigns targeting SSH and Telnet services. Threat actors from IP addresses associated with PPTECHNOLOGY LIMITED and other providers executed systematic brute-force attacks, successfully compromising honeypot systems through weak credentials. Once gaining access, attackers performed reconnaissance, system enumeration, and data exfiltration while attempting to cover their tracks using commands like 'rm -rf filter'. The analysis revealed over 400 file artifacts and multiple attack sessions showing coordinated botnet-style automation targeting vulnerable internet-facing services. This incident highlights the persistent threat landscape facing organizations with exposed SSH and Telnet services, demonstrating how attackers leverage automated tools and compromised infrastructure to systematically target weak authentication mechanisms across internet-connected systems.
2 weeks ago
Kill Chain
Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC
In June 2026, NetSPI security researchers discovered a critical privilege escalation vulnerability in Microsoft Azure's Role-Based Access Control (RBAC) system. The vulnerability existed in the built-in 'Anyscale Platform Administrator Role' which contained unconstrained Microsoft.Authorization/roleAssignments/write permissions, allowing arbitrary escalation to Owner-level privileges without proper Attribute-Based Access Control (ABAC) restrictions. This finding highlighted broader security gaps in Azure's rapidly expanding attack surface, which now includes over 200 services, 897 built-in RBAC roles, and 22,018 different permissions. Microsoft addressed the issue within two weeks of disclosure by removing the problematic permissions from the affected role. This incident represents a critical trend in cloud security as organizations increasingly rely on complex cloud permission models that can contain hidden escalation paths, emphasizing the urgent need for granular permission auditing and zero-trust access controls in multi-cloud environments.
2 weeks ago
Kill Chain
SonicWall SMA1000 Under Active Zero-Day Attack: CVE-2026-83548 & CVE-2026-83549
In September 2026, SonicWall disclosed that threat actors were actively exploiting two chained zero-day vulnerabilities in SMA1000 appliances used by large enterprises and critical infrastructure. CVE-2026-83548, a maximum-severity command injection flaw in the WorkPlace interface, is chained with CVE-2026-83549, a command injection vulnerability in the Management Console, enabling remote code execution attacks. The vulnerabilities affect SMA1000 6210, 7210, and 8200v models, with over 400 appliances potentially exposed online according to Shadowserver tracking. This incident highlights the escalating threat to secure remote access infrastructure, particularly as organizations increasingly rely on VPN appliances for hybrid work environments. The pattern of repeated SMA1000 zero-day exploitation throughout 2025-2026, including previous attacks by ransomware gangs confirmed by CISA, demonstrates how critical network infrastructure has become a prime target for sophisticated threat actors.
2 weeks ago
Kill Chain
Active Exploitation of Sangoma Switchvox Flaw Enables Reverse Shell Attacks
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP platforms that enables remote code execution. Horizon3 researchers discovered this critical flaw among 12 vulnerabilities reported in April 2026, with Sangoma releasing patches in July. Since August 2026, threat actors have systematically targeted the approximately 4,000 internet-exposed Switchvox systems, deploying reverse shells to establish persistent access and exfiltrate system information to remote command-and-control servers. This incident exemplifies the growing threat landscape targeting enterprise communication infrastructure, where VoIP systems have become prime targets for attackers seeking to establish footholds in corporate networks and potentially intercept sensitive communications.
2 weeks ago
Kill Chain
Silver Fox's Sophisticated Software Supply Chain Attack Disables Windows Security
In September 2026, Microsoft detected an active malware campaign by the Chinese threat group Silver Fox (Yinhu) targeting multinational organizations with operations in China. The attackers created high-fidelity counterfeit software download websites impersonating trusted vendors like Microsoft Edge, Kaspersky, and Baidu to distribute malicious installers. Once executed, these installers deployed ValleyRAT malware that established persistence, disabled Windows Update services, weakened Microsoft Defender protections, and communicated with command-and-control infrastructure on non-standard ports. The campaign affected multiple sectors including healthcare, manufacturing, gaming, technology, logistics, government, and education. This incident highlights the evolving sophistication of supply chain attacks and social engineering tactics, particularly as organizations increasingly rely on third-party software downloads. The campaign demonstrates how threat actors are adapting to security improvements by targeting the software acquisition process itself, making detection more challenging.
2 weeks ago
Kill Chain
Spring Ring Campaign: How Vishing Attacks Weaponized Microsoft Teams in 2026
Between January and April 2026, the "Spring Ring" threat operation targeted over 150 Microsoft Teams users across 10+ organizations using sophisticated voice phishing (vishing) attacks. Attackers impersonated internal IT support staff through Teams chats, then conducted voice calls to trick employees into installing remote access tools or executing malware. The most advanced variant employed NTLM relay attacks targeting domain controllers for full infrastructure compromise, demonstrating a significant evolution from traditional email phishing to real-time social engineering through trusted collaboration platforms. This incident reflects the accelerating shift toward platform-native attacks as threat actors exploit the inherent trust users place in enterprise collaboration tools. With vishing attacks doubling in the first half of 2026 according to CrowdStrike data, organizations face an urgent need to reassess security controls around identity verification and SaaS platform governance as traditional perimeter defenses prove inadequate against socially-engineered compromise vectors.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports