Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 145 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1729–1740 / 3490 reports
Critical RCE Vulnerability in Weaver E-cology: CVE-2026-22679
Government Administration6 months ago

Critical RCE Vulnerability in Weaver E-cology: CVE-2026-22679

In March 2026, a critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-22679, was discovered in Weaver (Fanwei) E-cology 10.0 versions prior to 20260312. This flaw resides in the "/papi/esearch/data/devops/dubboApi/debug/method" endpoint, allowing attackers to execute arbitrary commands by exploiting exposed debug functionality without authentication. The vulnerability has a CVSS score of 9.8, indicating its severity. ([thehackernews.com](https://thehackernews.com/2026/05/weaver-e-cology-rce-flaw-cve-2026-22679.html?utm_source=openai)) Active exploitation of this vulnerability was first observed on March 31, 2026, with attackers leveraging it to gain full control over affected systems. The exploitation involves crafting POST requests with malicious parameters to invoke command-execution helpers. Organizations using vulnerable versions are urged to update to version 20260312 or later to mitigate this risk. ([thehackernews.com](https://thehackernews.com/2026/05/weaver-e-cology-rce-flaw-cve-2026-22679.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Persistent OAuth Tokens: The Unseen Backdoor in Enterprise Security
Financial Services6 months ago

Persistent OAuth Tokens: The Unseen Backdoor in Enterprise Security

In May 2026, a significant security concern emerged regarding the widespread use of OAuth tokens in enterprise environments. Employees frequently connect AI tools, workflow automations, and productivity applications to platforms like Google and Microsoft, generating persistent OAuth tokens that often lack expiration dates and are not subject to automatic cleanup. This practice creates a substantial security gap, as these tokens can grant attackers unauthorized access without the need for passwords, bypassing traditional security measures such as multi-factor authentication. The inherent design of OAuth, which does not automatically revoke tokens when employees depart or change passwords, exacerbates this vulnerability. The urgency of addressing this issue is underscored by recent incidents where threat actors exploited OAuth tokens to gain unauthorized access to sensitive data. For instance, in August 2025, attackers used compromised OAuth tokens from the Salesloft-Drift integration to access Salesforce environments of over 700 organizations, leading to significant data exfiltration. ([checkred.com](https://checkred.com/resources/blog/when-oauth-tokens-go-rogue-lessons-from-the-salesloft-drift-breach/?utm_source=openai)) These events highlight the critical need for organizations to implement robust monitoring and management of OAuth grants to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
DarkSword Malware: A New Threat to iOS Devices
Government Administration6 months ago

DarkSword Malware: A New Threat to iOS Devices

In March 2026, Google's Threat Intelligence Group (GTIG) identified 'DarkSword,' a sophisticated iOS exploit chain targeting devices running iOS versions 18.4 through 18.7. This exploit leverages six vulnerabilities to achieve full device compromise, deploying malware families such as GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Initially observed in November 2025, DarkSword has been utilized by multiple threat actors, including state-sponsored groups like UNC6353, to target users in countries such as Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit is delivered through malicious or compromised websites, enabling attackers to steal sensitive data and execute unauthorized code on affected devices. ([malwarebytes.com](https://www.malwarebytes.com/blog/mobile/2026/03/a-darksword-hangs-over-unpatched-iphones?utm_source=openai)) The widespread adoption of DarkSword by various threat actors underscores a significant shift in the cyber threat landscape, highlighting the increasing accessibility and deployment of advanced mobile exploits. This incident emphasizes the critical importance of timely software updates and robust security practices to mitigate emerging threats. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-darksword-ios-fullchain-zeroday-multiactor/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Understanding the 'Copy Fail' Linux Vulnerability (CVE-2026-31431) and Its Implications
Information Technology/IT6 months ago

Understanding the 'Copy Fail' Linux Vulnerability (CVE-2026-31431) and Its Implications

In April 2026, Theori disclosed a critical local privilege escalation vulnerability, CVE-2026-31431, dubbed 'Copy Fail,' affecting Linux kernels since 2017. This flaw resides in the 'algif_aead' cryptographic interface, allowing unprivileged users to escalate privileges to root, thereby gaining full system control. Major distributions like Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16 are impacted. The vulnerability has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. ([tomshardware.com](https://www.tomshardware.com/software/linux/cisa-flags-actively-exploited-copy-fail-linux-kernel-flaw-enabling-root-takeover-across-major-distros-unpatched-systems-may-remain-vulnerable-to-attack?utm_source=openai)) The rapid public disclosure and the availability of a reliable proof-of-concept exploit have heightened concerns, especially in cloud and multi-tenant environments where untrusted code execution is common. Organizations are urged to apply patches promptly and consider temporary mitigations, such as disabling the affected cryptographic modules, to protect against potential exploitation. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Alerts on Active Exploitation of 'Copy Fail' Linux Vulnerability (CVE-2026-31431)
Government Administration6 months ago

CISA Alerts on Active Exploitation of 'Copy Fail' Linux Vulnerability (CVE-2026-31431)

In late April 2026, a critical vulnerability known as 'Copy Fail' (CVE-2026-31431) was disclosed, affecting Linux kernels released since 2017. This flaw resides in the algif_aead cryptographic interface, allowing unprivileged local users to escalate privileges to root by writing controlled bytes to the page cache of any readable file. Theori researchers released a proof-of-concept exploit demonstrating the vulnerability's reliability across major distributions, including Ubuntu, Amazon Linux, RHEL, and SUSE. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate patching to mitigate active exploitation risks. The rapid public disclosure and availability of a reliable exploit underscore the urgency for organizations to update their systems promptly. Given the widespread use of affected Linux distributions in enterprise and cloud environments, unpatched systems are at significant risk of compromise, potentially leading to unauthorized access and control over critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Authentication Bypass Vulnerability in MOVEit Automation: CVE-2026-4670
Financial Services6 months ago

Critical Authentication Bypass Vulnerability in MOVEit Automation: CVE-2026-4670

In April 2026, Progress Software disclosed a critical authentication bypass vulnerability (CVE-2026-4670) in its MOVEit Automation managed file transfer application. This flaw allows unauthenticated remote attackers to gain unauthorized access to affected systems without user interaction. The vulnerability impacts MOVEit Automation versions prior to 2025.1.5, 2025.0.9, and 2024.1.8. Exploitation could lead to unauthorized access, administrative control, and potential data exposure. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670/?utm_source=openai)) Given the widespread use of MOVEit Automation in enterprise environments, this vulnerability poses a significant risk. Organizations are urged to upgrade to the latest patched versions immediately to mitigate potential exploitation. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/critical-moveit-automation-auth-bypass-vulnerability-fixed-cve-2026-4670/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
PyTorch Lightning Supply Chain Attack: A Wake-Up Call for Developers
Computer Software/Engineering6 months ago

PyTorch Lightning Supply Chain Attack: A Wake-Up Call for Developers

In April 2026, versions 2.6.2 and 2.6.3 of the PyTorch Lightning package were compromised and published on the Python Package Index (PyPI). These versions contained malicious code that, upon import, initiated a background process to download and execute an obfuscated JavaScript payload. This payload targeted sensitive information, including environment files, API keys, GitHub tokens, and credentials stored in browsers such as Chrome, Firefox, and Brave. Additionally, it interacted with cloud service APIs (AWS, Azure, GCP) to exfiltrate credentials and had the capability to execute arbitrary system commands. This incident underscores the escalating threat of supply chain attacks in the software development ecosystem. The compromise of widely-used packages like PyTorch Lightning highlights the need for enhanced vigilance and robust security measures in managing software dependencies to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Progress Software Patches Critical MOVEit Automation Vulnerabilities
Financial Services6 months ago

Progress Software Patches Critical MOVEit Automation Vulnerabilities

In April 2026, Progress Software identified and patched two critical vulnerabilities in MOVEit Automation, a managed file transfer solution widely used in enterprise environments. The most severe, CVE-2026-4670, is an authentication bypass flaw with a CVSS score of 9.8, allowing unauthenticated remote attackers to gain unauthorized access. The second, CVE-2026-5174, involves improper input validation that could lead to privilege escalation. Exploitation of these vulnerabilities could result in unauthorized access, administrative control, and potential data exposure. ([thehackernews.com](https://thehackernews.com/2026/05/progress-patches-critical-moveit.html?utm_source=openai)) This incident underscores the persistent threat posed by vulnerabilities in widely deployed enterprise software. Organizations are reminded of the importance of timely patch management and vigilant monitoring to mitigate risks associated with such critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VENOMOUS#HELPER Phishing Campaign: A Wake-Up Call for RMM Tool Security
Information Technology/IT6 months ago

VENOMOUS#HELPER Phishing Campaign: A Wake-Up Call for RMM Tool Security

Since April 2025, a sophisticated phishing campaign named VENOMOUS#HELPER has targeted over 80 organizations, primarily in the U.S. Attackers impersonated the U.S. Social Security Administration, sending emails that directed recipients to download malicious executables disguised as official documents. These executables installed legitimate Remote Monitoring and Management (RMM) tools—SimpleHelp and ScreenConnect—on victims' systems, granting attackers persistent remote access. The use of these legitimate tools allowed the attackers to evade detection by standard security measures. ([thehackernews.com](https://thehackernews.com/2026/05/phishing-campaign-hits-80-orgs-using.html?utm_source=openai)) This incident underscores a growing trend where cybercriminals exploit trusted software to maintain undetected access within networks. The dual deployment of RMM tools highlights the need for organizations to scrutinize the use of such software and implement robust monitoring to detect unauthorized installations. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rmm-tools-stealthy-phishing-campaign?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Wireshark 4.6.5 Release: Addressing 43 Vulnerabilities Amid AI-Assisted Reports
Computer/Network Security6 months ago

Wireshark 4.6.5 Release: Addressing 43 Vulnerabilities Amid AI-Assisted Reports

On May 3, 2026, Wireshark released version 4.6.5, addressing 43 vulnerabilities, including 38 CVEs. This significant update was driven by a surge in AI-assisted vulnerability reports, highlighting the evolving landscape of cybersecurity threats. The vulnerabilities, if exploited, could allow attackers to execute arbitrary code or cause denial-of-service conditions, emphasizing the critical need for timely software updates. The rapid identification and disclosure of these vulnerabilities underscore the dual role of AI in cybersecurity—both as a tool for defenders and a resource for attackers. Organizations must remain vigilant, ensuring that their security practices evolve alongside technological advancements to mitigate emerging threats effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
April 2026 Cybersecurity Threats: AI-Powered Phishing and Linux 'Copy Fail' Vulnerability
Financial Services6 months ago

April 2026 Cybersecurity Threats: AI-Powered Phishing and Linux 'Copy Fail' Vulnerability

In late April 2026, two significant cybersecurity threats emerged. First, a critical vulnerability known as 'Copy Fail' (CVE-2026-31431) was discovered in the Linux kernel, affecting versions released since 2017. This flaw allows unprivileged local users to escalate privileges to root by exploiting the kernel's cryptographic interface. Despite patches being available, many distributions had not yet implemented them, leaving systems vulnerable. Second, researchers identified 'Bluekit,' an advanced phishing kit capable of emulating over 40 global brands and bypassing multi-factor authentication protocols. Bluekit utilizes jailbroken AI models to generate convincing phishing emails and includes features like real-time session hijacking and anti-bot detection, making it a formidable tool for cybercriminals. These incidents underscore the evolving sophistication of cyber threats, particularly the integration of AI in phishing campaigns and the exploitation of longstanding vulnerabilities in widely used systems. Organizations must prioritize timely patch management and enhance their defenses against AI-driven social engineering attacks to mitigate these risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Breaking the Code: Multi-Stage 'Code of Conduct' Phishing Campaign Leads to AiTM Token Compromise
Health Care / Life Sciences6 months ago

Breaking the Code: Multi-Stage 'Code of Conduct' Phishing Campaign Leads to AiTM Token Compromise

In April 2026, a sophisticated phishing campaign targeted over 35,000 users across 13,000 organizations, primarily in the United States. Attackers employed 'code of conduct' themed emails with polished HTML templates to create a sense of urgency. The multi-stage attack involved CAPTCHA challenges and intermediate pages, culminating in an adversary-in-the-middle (AiTM) phishing site that intercepted authentication tokens, effectively bypassing non-phishing-resistant multifactor authentication (MFA) and granting immediate account access. This incident underscores the evolving sophistication of phishing tactics, highlighting the need for organizations to implement phishing-resistant MFA methods and enhance user awareness training to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports