Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 147 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1753–1764 / 3490 reports
Supply Chain Attack: Malicious Ruby Gems and Go Modules Compromise CI Pipelines
Computer Software/Engineering6 months ago

Supply Chain Attack: Malicious Ruby Gems and Go Modules Compromise CI Pipelines

In May 2026, a sophisticated supply chain attack was identified involving the GitHub account 'BufferZoneCorp,' which published malicious Ruby gems and Go modules. These packages initially appeared benign but were later updated to exfiltrate credentials from environment variables and local files, tamper with GitHub Actions environments, and establish SSH persistence. The Ruby gems targeted sensitive information such as SSH keys and AWS credentials, while the Go modules manipulated GitHub Actions by poisoning GOPROXY, disabling checksum verification, and planting fake Go wrappers in execution paths. ([app.daily.dev](https://app.daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers are urged to scrutinize third-party packages, monitor for unauthorized changes in CI/CD workflows, and implement robust security measures to protect against such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cybersecurity Experts Sentenced for BlackCat Ransomware Attacks
Computer/Network Security6 months ago

Cybersecurity Experts Sentenced for BlackCat Ransomware Attacks

In April 2026, the U.S. Department of Justice sentenced cybersecurity professionals Ryan Goldberg and Kevin Martin to four years in prison for orchestrating BlackCat ransomware attacks between April and December 2023. Collaborating with co-conspirator Angelo Martino, they deployed the ALPHV/BlackCat ransomware against multiple U.S. victims, extorting approximately $1.2 million in Bitcoin from at least one victim. The trio, leveraging their industry expertise, agreed to share 20% of the ransoms with the ransomware administrators in exchange for access to the malware and its extortion platform. ([justice.gov](https://www.justice.gov/usao-sdfl/pr/two-men-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores a troubling trend of insiders exploiting their cybersecurity knowledge for malicious purposes. The involvement of industry professionals in cybercrime highlights the need for stringent internal controls and continuous monitoring to prevent such breaches. Organizations must remain vigilant against both external threats and potential internal vulnerabilities to safeguard their systems and data.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cybercrime Groups Exploit Vishing and SSO in Rapid SaaS Extortion Attacks
Financial Services6 months ago

Cybercrime Groups Exploit Vishing and SSO in Rapid SaaS Extortion Attacks

In October 2025, two cybercrime groups, Cordial Spider and Snarky Spider, initiated rapid, high-impact attacks targeting U.S. organizations across sectors such as academia, aviation, retail, hospitality, automotive, financial services, legal, and technology. Employing voice phishing (vishing) and adversary-in-the-middle (AiTM) techniques, they directed employees to fraudulent single sign-on (SSO) pages to capture credentials and session tokens. This access allowed them to infiltrate SaaS environments, register attacker-controlled multi-factor authentication (MFA) devices, suppress security notifications, and exfiltrate sensitive data for extortion purposes. ([cyberscoop.com](https://cyberscoop.com/crowdstrike-cordial-spider-snarky-spider-extortion-attacks/?utm_source=openai)) These incidents underscore a significant evolution in cybercriminal tactics, emphasizing the urgency for organizations to enhance their defenses against sophisticated social engineering and identity-based attacks. The rapidity and precision of these operations highlight the need for robust security measures within SaaS platforms to mitigate such threats. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/defending-against-cordial-spider-and-snarky-spider-with-falcon-shield/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Insider Threats: The 2023 ALPHV Ransomware Exploits by Cybersecurity Professionals
Health Care / Life Sciences6 months ago

Insider Threats: The 2023 ALPHV Ransomware Exploits by Cybersecurity Professionals

In 2023, former cybersecurity professionals Ryan Goldberg and Kevin Martin exploited their expertise to conduct ransomware attacks using the ALPHV/BlackCat variant. Over a six-month period, they targeted multiple U.S. organizations, including a Florida medical company, a Maryland pharmaceutical firm, a California doctor's office, a California engineering company, and a Virginia drone manufacturer. Their actions led to significant operational disruptions and financial losses, with at least one victim paying a $1.3 million ransom. ([justice.gov](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores the alarming trend of insiders leveraging privileged access and knowledge for malicious purposes. It highlights the critical need for robust internal controls, continuous monitoring, and stringent access management to mitigate insider threats within organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding CVE-2026-31431: The 'Copy Fail' Linux Kernel Vulnerability
Information Technology/IT6 months ago

Understanding CVE-2026-31431: The 'Copy Fail' Linux Kernel Vulnerability

In April 2026, a critical local privilege escalation vulnerability, CVE-2026-31431, known as 'Copy Fail,' was disclosed in the Linux kernel. This flaw, present since 2017, allows unprivileged local users to gain root access by exploiting a logic bug in the 'authencesn' cryptographic template. The vulnerability affects major Linux distributions, including Ubuntu, Amazon Linux, RHEL, and SUSE. Theori, the security firm that discovered the flaw, developed a 732-byte Python exploit capable of reliably granting root access across all affected distributions. Patches have been released to address this issue. ([copy.fail](https://copy.fail/?utm_source=openai)) The 'Copy Fail' vulnerability underscores the importance of timely patch management and proactive security measures. Its widespread impact across multiple Linux distributions highlights the need for organizations to prioritize system updates and monitor for emerging threats to maintain robust security postures. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/30/copyfail-linux-lpe-vulnerability-cve-2026-31431/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PyTorch Lightning Supply Chain Attack: What You Need to Know
Computer Software/Engineering6 months ago

PyTorch Lightning Supply Chain Attack: What You Need to Know

In April 2026, threat actors compromised the PyTorch Lightning package by publishing malicious versions 2.6.2 and 2.6.3 on the Python Package Index (PyPI). These versions contained obfuscated JavaScript payloads that executed upon import, leading to the theft of credentials, authentication tokens, and cloud secrets. The attack also attempted to poison GitHub repositories by creating public repositories with names like 'EveryBoiWeBuildIsaWormBoi'. The malicious versions were quickly identified and removed from PyPI, and developers were advised to downgrade to version 2.6.1 and rotate any potentially exposed credentials. ([semgrep.dev](https://semgrep.dev/blog/2026/malicious-dependency-in-pytorch-lightning-used-for-ai-training?utm_source=openai)) This incident underscores the growing trend of supply chain attacks targeting widely-used open-source packages. The rapid detection and response highlight the importance of vigilant monitoring and prompt action in mitigating such threats. Organizations are reminded to regularly audit their dependencies and implement robust security practices to protect against similar attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI Uncovers Critical Vulnerabilities in OpenEMR EHR Platform
Health Care / Life Sciences6 months ago

AI Uncovers Critical Vulnerabilities in OpenEMR EHR Platform

In April 2026, an AI-driven analysis by cybersecurity firm Aisle uncovered 38 previously unknown vulnerabilities in OpenEMR, an open-source electronic health record platform utilized by over 100,000 healthcare providers globally. These vulnerabilities, ranging from medium to critical severity, included issues like missing authorization checks, cross-site scripting (XSS), SQL injection, path traversal, and session-related flaws. Exploitation of these vulnerabilities could have led to full database compromises, large-scale exfiltration of protected health information (PHI), and remote code execution on servers. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/ai-finds-38-security-flaws-openemr?utm_source=openai)) The rapid identification and remediation of these flaws underscore the transformative impact of AI in vulnerability research, significantly reducing the time required for such analyses. However, this also highlights the growing challenge for security teams to triage and address the increasing volume of discovered vulnerabilities, emphasizing the need for robust and proactive cybersecurity measures in the healthcare sector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical RCE Vulnerability CVE-2026-3854 in GitHub Enterprise Server
Computer Software/Engineering6 months ago

Critical RCE Vulnerability CVE-2026-3854 in GitHub Enterprise Server

In March 2026, a critical remote code execution (RCE) vulnerability, CVE-2026-3854, was identified in GitHub Enterprise Server. This flaw allowed attackers with push access to a repository to execute arbitrary code on the server by exploiting improperly sanitized push option values during git push operations. The vulnerability was reported by cloud security firm Wiz through GitHub's bug bounty program and was promptly addressed by GitHub, with patches released for affected versions. The discovery of CVE-2026-3854 underscores the evolving landscape of cybersecurity threats, particularly the role of AI in identifying vulnerabilities within closed-source binaries. This incident highlights the necessity for organizations to adopt proactive security measures and stay vigilant against emerging attack vectors facilitated by advanced technologies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
EtherRAT Campaign: A New Era of Malware Distribution via GitHub and Ethereum
Information Technology/IT6 months ago

EtherRAT Campaign: A New Era of Malware Distribution via GitHub and Ethereum

In March 2026, a sophisticated cyber campaign was identified targeting enterprise administrators, DevOps engineers, and security analysts. The attackers employed SEO poisoning to manipulate search engine results, leading victims to GitHub repositories that impersonated legitimate administrative tools. These repositories hosted malicious MSI installers, which, upon execution, deployed EtherRAT—a Node.js-based backdoor. Notably, EtherRAT utilized Ethereum smart contracts to dynamically resolve command-and-control (C2) addresses, enhancing the malware's resilience and evasion capabilities. This incident underscores a strategic shift in cyberattack methodologies, combining social engineering with decentralized technologies to evade detection and maintain persistence. The use of blockchain for C2 infrastructure highlights the evolving tactics of threat actors, necessitating adaptive defense strategies to counter such innovative threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Google Patches Critical RCE Vulnerability in Gemini CLI
Computer Software/Engineering6 months ago

Google Patches Critical RCE Vulnerability in Gemini CLI

In April 2026, Google addressed a critical security vulnerability in the Gemini CLI, specifically affecting the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow. This flaw, assigned a CVSS score of 10.0, allowed unprivileged external attackers to execute arbitrary commands on host systems by injecting malicious content into Gemini configuration files. The vulnerability was particularly concerning in Continuous Integration (CI) environments where Gemini CLI operated in headless mode, automatically trusting workspace folders and potentially leading to remote code execution via malicious environment variables in the local .gemini/ directory. ([thehackernews.com](https://thehackernews.com/2026/04/google-fixes-cvss-10-gemini-cli-ci-rce.html?utm_source=openai)) The incident underscores the critical importance of securing CI/CD pipelines against supply chain attacks. As organizations increasingly rely on automated workflows, ensuring that tools like Gemini CLI do not implicitly trust unverified inputs is essential to prevent potential exploitation and maintain the integrity of development environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DEEP#DOOR: Unveiling the Python Backdoor Exploiting Tunneling Services
Financial Services6 months ago

DEEP#DOOR: Unveiling the Python Backdoor Exploiting Tunneling Services

In April 2026, cybersecurity researchers identified a sophisticated Python-based backdoor framework named DEEP#DOOR targeting Windows systems. The attack initiates with an obfuscated batch script that disables Windows security features and extracts an embedded Python payload, establishing persistence through multiple mechanisms such as startup folder entries, registry run keys, and scheduled tasks. The malware communicates with attacker infrastructure via a public TCP tunneling service, enabling remote command execution and extensive surveillance capabilities, including keylogging, screenshot capture, and credential harvesting from browsers and cloud services. DEEP#DOOR employs advanced evasion techniques, including sandbox and virtual machine detection, to avoid detection and complicate incident response efforts. This incident underscores the evolving sophistication of threat actors who leverage fileless, script-driven intrusion frameworks that utilize native system components and interpreted languages like Python. The use of public tunneling services for command-and-control communications highlights a trend towards minimizing forensic footprints and blending malicious traffic with legitimate network activity, posing significant challenges for traditional detection methods.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Bishop Fox Unveils AIMap: A New Tool for Securing AI Agent Infrastructures
Information Technology/IT6 months ago

Bishop Fox Unveils AIMap: A New Tool for Securing AI Agent Infrastructures

On April 30, 2026, Bishop Fox introduced AIMap, an open-source tool designed to help organizations discover, analyze, and test their exposed AI agent infrastructure. AIMap enables defenders to identify internet-exposed AI systems, assess their risk levels, and conduct controlled security testing to understand and mitigate real-world attack surfaces. The tool addresses vulnerabilities such as unauthenticated access, tool abuse, and prompt leakage, which are increasingly exploited by attackers. The release of AIMap is particularly relevant as AI systems become more integrated into organizational operations, presenting new attack vectors. By providing visibility into AI agent infrastructures, AIMap empowers organizations to proactively secure their AI deployments against emerging threats.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports