Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
DigitalMint Insider Ransomware Scheme Unveiled
In 2023, Angelo John Martino III, a ransomware negotiator at DigitalMint, exploited his position to orchestrate at least 10 ransomware attacks, extorting over $75 million. Martino, along with co-conspirators, infiltrated networks, encrypted data, and demanded ransoms, even negotiating with victims he had attacked. This breach highlights the severe risks posed by insider threats in cybersecurity firms. The incident underscores the critical need for robust internal controls and vigilant monitoring to prevent such breaches, especially as ransomware tactics evolve and insider threats become more sophisticated.
6 months ago
Kill Chain
PhantomRaven NPM Attack 2026: A Wake-Up Call for Open-Source Security
Between November 2025 and February 2026, the 'PhantomRaven' supply-chain attack targeted the npm registry, introducing 88 malicious packages through 50 disposable accounts. These packages, often mimicking legitimate projects like Babel and GraphQL Codegen, utilized a technique called Remote Dynamic Dependencies (RDD) to fetch and execute malicious code from external URLs during installation. The malware harvested sensitive information from developers' systems, including emails, CI/CD tokens, and system details, subsequently exfiltrating this data to the attackers' command-and-control servers. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages/?utm_source=openai)) This incident underscores the escalating threat of supply-chain attacks in open-source ecosystems, highlighting the need for developers to exercise caution when integrating third-party packages. The use of AI-generated package names and sophisticated evasion techniques like RDD exemplify the evolving tactics of threat actors, emphasizing the importance of vigilant package management and verification practices.
6 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading medical technology company, experienced a significant cyberattack attributed to the pro-Iranian hacktivist group Handala. The attackers claimed to have infiltrated Stryker's global network, exfiltrated 50 terabytes of sensitive data, and deployed wiper malware that erased data on over 200,000 systems, servers, and mobile devices. This attack led to widespread operational disruptions across Stryker's offices in 79 countries, severely impacting their ability to deliver medical products and services. ([investing.com](https://www.investing.com/news/stock-market-news/stryker-stock-falls-34-on-iranlinked-cyberattack-report-93CH-4554963?utm_source=openai)) This incident underscores the escalating threat posed by politically motivated cyberattacks targeting critical infrastructure sectors. Organizations in the healthcare and medical technology industries must enhance their cybersecurity measures to protect against such sophisticated and destructive attacks.
6 months ago
Kill Chain
Critical n8n RCE Vulnerability (CVE-2025-68613) Exposes Systems to Full Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users to execute arbitrary code on the server by exploiting insufficient isolation in the workflow expression evaluation system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive data and modification of workflows. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-68613?utm_source=openai)) The vulnerability was addressed in n8n versions 1.120.4, 1.121.1, and 1.122.0. However, as of March 2026, over 40,000 unpatched instances remain exposed online, with significant concentrations in North America and Europe. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/?utm_source=openai))
6 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing Critical Zero-Day Vulnerabilities
In March 2026, Microsoft released patches addressing 84 security vulnerabilities across its software portfolio, including two publicly disclosed zero-day flaws: CVE-2026-26127, a denial-of-service vulnerability in .NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. Notably, over half of the patched vulnerabilities were related to privilege escalation, underscoring the critical need for organizations to apply these updates promptly to mitigate potential exploitation risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This incident highlights the ongoing challenges in securing complex software ecosystems and the importance of timely patch management. The disclosure of zero-day vulnerabilities before patches are available increases the window of opportunity for threat actors, emphasizing the need for organizations to maintain robust vulnerability management practices.
6 months ago
Kill Chain
SAP's March 2026 Security Patches Address Critical Vulnerabilities
In March 2026, SAP released security patches addressing critical vulnerabilities in its enterprise software. Notably, CVE-2019-17571, a code injection flaw in SAP Quotation Management Insurance (FS-QUO), and CVE-2026-27685, an insecure deserialization issue in SAP NetWeaver Enterprise Portal Administration, were both patched. These vulnerabilities could allow remote code execution, potentially leading to full system compromise. ([securityweek.com](https://www.securityweek.com/sap-patches-critical-fs-quo-netweaver-vulnerabilities/?utm_source=openai)) The timely release of these patches underscores the importance of proactive vulnerability management. Organizations are urged to apply these updates promptly to mitigate risks associated with these critical flaws.
6 months ago
Kill Chain
Critical n8n Vulnerabilities Expose Systems to Remote Code Execution
In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. Notably, CVE-2026-27577 and CVE-2026-27493 allowed for remote code execution (RCE) through expression sandbox escapes and unauthenticated expression evaluations via Form nodes, respectively. These flaws enabled attackers to execute arbitrary commands on the n8n host, potentially leading to full system compromise. ([thehackernews.com](https://thehackernews.com/2026/03/critical-n8n-flaws-allow-remote-code.html?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of timely software updates and vigilant security practices. Organizations utilizing n8n are urged to upgrade to patched versions immediately to mitigate potential exploitation risks.
6 months ago
Kill Chain
Perplexity Comet AI Browser Phishing Attack 2026
In March 2026, security researchers demonstrated a critical vulnerability in Perplexity's Comet AI browser, where attackers could manipulate the browser's AI assistant into executing phishing scams autonomously. By intercepting the browser's communication with AI services and feeding it into a Generative Adversarial Network (GAN), the researchers trained the AI to bypass its security measures and enter user credentials into malicious websites within minutes. This exploit highlights a significant shift in attack vectors, targeting AI models directly rather than end-users. The incident underscores the evolving threat landscape where AI-driven systems can be manipulated to perform unauthorized actions, emphasizing the need for robust security measures in AI integrations. As AI technologies become more prevalent, ensuring their resilience against such sophisticated attacks is paramount to maintaining user trust and data security.
6 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Notably, none of these vulnerabilities were reported as actively exploited in the wild at the time of release. The update also included eight critical vulnerabilities, such as CVE-2026-21536, a remote code execution flaw in the Microsoft Devices Pricing Program, which Microsoft mitigated server-side without requiring user action. This Patch Tuesday marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's proactive security measures. However, the presence of publicly disclosed vulnerabilities underscores the importance of timely patch application to mitigate potential risks.
6 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading U.S. medical technology company, experienced a significant cyberattack attributed to the pro-Palestinian hacktivist group Handala. The attackers reportedly utilized wiper malware to erase data from over 200,000 systems, including servers and mobile devices, leading to widespread operational disruptions across Stryker's global network. Employees in multiple countries, notably Ireland, were sent home as the company worked to contain the incident. Handala claimed the attack was retaliation for a missile strike that resulted in civilian casualties in Iran. This incident underscores the escalating trend of state-sponsored hacktivism targeting critical infrastructure and healthcare sectors. Organizations must enhance their cybersecurity measures to defend against sophisticated threats that aim not only to steal data but also to cause operational paralysis. The use of wiper malware highlights the need for robust data backup and recovery strategies to mitigate the impact of such destructive attacks.
6 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Key Vulnerabilities and Updates
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Notably, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Additionally, a critical remote code execution vulnerability, CVE-2026-21536, affecting the Microsoft Devices Pricing Program, was mitigated server-side without requiring user action. While none of these vulnerabilities were reported as actively exploited in the wild, organizations are advised to apply the patches promptly to mitigate potential risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) The absence of actively exploited zero-day vulnerabilities in this release marks a positive shift from previous months. However, the public disclosure of certain flaws prior to patch availability underscores the importance of timely updates. Organizations should remain vigilant, as threat actors may exploit unpatched systems, emphasizing the need for robust patch management practices. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))
6 months ago
Kill Chain
Salesforce Experience Cloud Guest User Misconfiguration Breach 2026
In March 2026, the cybercriminal group ShinyHunters exploited misconfigured guest user profiles in Salesforce's Experience Cloud, leading to unauthorized access to sensitive customer data. By utilizing a modified version of the open-source tool AuraInspector, the attackers scanned public-facing Experience Cloud sites and extracted data without authentication. This breach impacted approximately 400 organizations, including high-profile companies such as Snowflake, Okta, LastPass, Sony, AMD, and Salesforce itself. The compromised data included names, phone numbers, and other CRM information, which were subsequently used for social engineering and voice phishing campaigns. Salesforce confirmed that the issue stemmed from customer-configured settings rather than a vulnerability in its platform. ([techradar.com](https://www.techradar.com/pro/security/shinyhunters-claims-its-behind-ongoing-salesforce-aura-data-theft-assault-warns-more-attacks-to-come?utm_source=openai)) This incident underscores the critical importance of proper configuration and regular auditing of cloud-based services. Misconfigurations, especially in widely used platforms like Salesforce, can lead to significant data breaches, emphasizing the need for organizations to adhere to security best practices and continuously monitor their systems for potential vulnerabilities.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports