Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 148 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1765–1776 / 3490 reports
RedTail Malware's Exploitation of PHP Vulnerability CVE-2024-4577: A 2026 Cybersecurity Threat
Information Technology/IT6 months ago

RedTail Malware's Exploitation of PHP Vulnerability CVE-2024-4577: A 2026 Cybersecurity Threat

In April 2026, a significant cybersecurity incident was documented involving the exploitation of the PHP-CGI vulnerability CVE-2024-4577 by the RedTail cryptomining malware. Attackers utilized the 'libredtail-http' User-Agent to perform HTTP POST actions, leading to unauthorized command execution and deployment of the RedTail malware. This campaign targeted various systems globally, aiming to hijack computing resources for illicit cryptocurrency mining. The rapid exploitation of this vulnerability underscores the critical need for timely patching and robust security measures to prevent such attacks. Organizations are advised to update their PHP installations promptly and monitor network traffic for indicators of compromise associated with the 'libredtail-http' User-Agent.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Anthropic's Claude Mythos AI Model: A Double-Edged Sword in Cybersecurity
Financial Services6 months ago

Anthropic's Claude Mythos AI Model: A Double-Edged Sword in Cybersecurity

In April 2026, Anthropic unveiled 'Claude Mythos Preview,' an advanced AI model capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. Due to the potential misuse of its capabilities, Anthropic restricted its release, collaborating with over 50 major organizations, including Amazon, Google, Microsoft, and the U.S. government, under 'Project Glasswing' to responsibly address these vulnerabilities. This development underscores the dual-edged nature of AI advancements in cybersecurity, highlighting the need for stringent controls and ethical considerations in deploying such powerful technologies. The emergence of AI agents like Mythos signifies a paradigm shift in cybersecurity, where autonomous systems can both fortify and threaten digital infrastructures. Organizations must adapt by implementing robust identity and access management frameworks tailored for AI entities to mitigate risks associated with their deployment.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Directs Immediate Patching of Exploited Windows Zero-Day Vulnerability
Government Administration6 months ago

CISA Directs Immediate Patching of Exploited Windows Zero-Day Vulnerability

In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical Windows vulnerability, CVE-2026-32202, exploited in zero-day attacks. This flaw, stemming from an incomplete fix of a previous vulnerability (CVE-2026-21510), allows attackers to steal NTLM hashes without user interaction, facilitating unauthorized access and lateral movement within networks. The Russian state-sponsored group APT28 (Fancy Bear) has been linked to exploiting this vulnerability in attacks targeting Ukraine and EU countries in December 2025. The urgency of this directive underscores the persistent threat posed by state-sponsored cyber actors and the critical need for timely and comprehensive patching. Organizations must remain vigilant, ensuring that security updates are applied promptly to mitigate risks associated with such vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Vercel Breach 2026: Lessons in Third-Party AI Tool Security
Computer Software/Engineering6 months ago

Vercel Breach 2026: Lessons in Third-Party AI Tool Security

In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, including API keys and database credentials. The breach was traced back to the Lumma Stealer malware, which had infected a Context.ai employee's workstation in February 2026. The malware harvested credentials, enabling the attacker to pivot into Vercel's infrastructure. Vercel has since notified affected customers and recommended immediate credential rotation and enhanced security measures. This incident underscores the escalating risks associated with third-party integrations and the necessity for stringent access controls and continuous monitoring of OAuth permissions. Organizations are urged to reassess their security postures concerning third-party tools to mitigate potential supply chain vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
GitHub's Swift Response to CVE-2026-3854: Securing Millions of Repositories
Computer Software/Engineering6 months ago

GitHub's Swift Response to CVE-2026-3854: Securing Millions of Repositories

In March 2026, GitHub addressed a critical remote code execution vulnerability, identified as CVE-2026-3854, which affected GitHub.com and GitHub Enterprise Server. The flaw allowed attackers with push access to a repository to execute arbitrary code on the server by exploiting improperly sanitized user-supplied push options during git push operations. This vulnerability posed a significant risk, potentially exposing millions of private repositories to unauthorized access. GitHub promptly patched the issue within hours of its discovery, and no evidence of exploitation prior to the fix was found. The rapid identification and remediation of CVE-2026-3854 underscore the importance of proactive vulnerability management in safeguarding critical code repositories. This incident highlights the necessity for organizations to maintain vigilant security practices and promptly apply patches to mitigate emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Qinglong Task Scheduler Vulnerabilities Lead to Cryptomining Attacks
Computer Software/Engineering6 months ago

Qinglong Task Scheduler Vulnerabilities Lead to Cryptomining Attacks

In early February 2026, attackers began exploiting two authentication bypass vulnerabilities, CVE-2026-3965 and CVE-2026-4047, in the Qinglong open-source task scheduling tool. These flaws allowed unauthenticated access to protected admin endpoints, enabling remote code execution. Threat actors leveraged this access to deploy cryptomining malware on developers' servers, leading to significant CPU resource consumption and operational disruptions. The vulnerabilities were publicly disclosed at the end of February, with initial patches proving insufficient. A comprehensive fix was implemented in early March 2026. This incident underscores the critical importance of promptly addressing security vulnerabilities in widely-used open-source tools. The exploitation of Qinglong's flaws highlights the persistent threat posed by cryptomining attacks and the necessity for developers to maintain up-to-date software and implement robust security measures to protect their systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
LiteLLM CVE-2026-42208: Rapid Exploitation of Critical SQL Injection Vulnerability
Computer Software/Engineering6 months ago

LiteLLM CVE-2026-42208: Rapid Exploitation of Critical SQL Injection Vulnerability

In April 2026, a critical SQL injection vulnerability (CVE-2026-42208) was discovered in BerriAI's LiteLLM Python package, a widely used AI gateway. This flaw allowed unauthenticated attackers to execute arbitrary SQL commands against the proxy's database, potentially leading to unauthorized access and modification of sensitive data. The vulnerability affected versions >=1.81.16 and <1.83.7. Despite a patch being released on April 19, 2026, exploitation attempts were observed within 36 hours of public disclosure, indicating rapid weaponization by threat actors. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) This incident underscores the increasing speed at which cyber adversaries exploit newly disclosed vulnerabilities, particularly in widely adopted open-source software. Organizations relying on such tools must prioritize timely patching and implement robust monitoring to detect and mitigate exploitation attempts promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack
Computer Software/Engineering6 months ago

SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack

On April 29, 2026, a sophisticated supply chain attack targeted SAP's JavaScript and cloud application development ecosystem by compromising several npm packages, including mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, and @cap-js/sqlite@2.2.2. The attackers introduced a preinstall script that downloaded and executed a malicious payload via the Bun JavaScript runtime, enabling the theft of developer credentials, GitHub and npm tokens, and cloud service secrets. The stolen data was exfiltrated to public GitHub repositories created on the victims' accounts, labeled with the description 'A Mini Shai-Hulud has Appeared.' ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments, particularly within widely-used frameworks like SAP's CAP model. The attack's sophistication, including its ability to propagate through developer workflows and exploit AI coding agent configurations, highlights the need for enhanced security measures in software development pipelines. ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Credential-Stealing Malware Found in Official SAP npm Packages
Computer Software/Engineering6 months ago

Credential-Stealing Malware Found in Official SAP npm Packages

In April 2026, a sophisticated supply chain attack targeted SAP's Cloud Application Programming Model (CAP) by compromising four official npm packages: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The attackers, identified as TeamPCP, injected malicious 'preinstall' scripts into these packages, which, upon installation, executed a multi-stage payload designed to steal a wide array of credentials from developers' systems and CI/CD environments. The stolen data included npm and GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud. The malware also attempted to extract secrets directly from the CI runner's memory, bypassing standard log masking mechanisms. The exfiltrated data was encrypted and uploaded to public GitHub repositories under the victim's account, with descriptions indicating the presence of 'A Mini Shai-Hulud.' This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools and the necessity for robust security measures in software development pipelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Vidar Infostealer 2026 Breach: A Wake-Up Call for Enhanced Security Measures
Financial Services6 months ago

Vidar Infostealer 2026 Breach: A Wake-Up Call for Enhanced Security Measures

In early 2026, the Vidar infostealer malware emerged as a dominant threat in the cybercriminal ecosystem, exploiting the void left by the takedowns of Lumma and Rhadamanthys. Vidar's operators released significant upgrades and expanded distribution channels, leading to widespread infections across various sectors. The malware targets sensitive data, including credentials, cookies, and cryptocurrency wallets, facilitating unauthorized access and potential financial losses. Organizations such as Pickett & Associates, Deloitte, KPMG, and Samsung were among those compromised due to inadequate multi-factor authentication (MFA) enforcement, resulting in the exfiltration of substantial volumes of sensitive data. ([techradar.com](https://www.techradar.com/pro/security/dozens-of-organizations-fall-victim-to-infostealers-after-failing-to-enforce-mfa?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, particularly MFA, to protect against credential theft. The rapid evolution and distribution of infostealer malware like Vidar highlight the need for continuous vigilance and proactive defense strategies to mitigate emerging cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations
Computer/Network Security6 months ago

Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations

In April 2026, a rare conflict erupted between two emerging ransomware-as-a-service (RaaS) groups, 0APT and KryBit. 0APT, initially known for fabricating victim claims, targeted rival ransomware operators, including KryBit, by leaking their operational data. This exposure revealed KryBit's infrastructure, personnel details, and victim negotiations. In retaliation, KryBit breached 0APT's systems, exposing fabricated victim lists and defacing 0APT's leak site. This mutual exposure has significantly disrupted both groups' operations, necessitating infrastructure rebuilding and rebranding efforts. This incident underscores the volatile nature of cybercriminal alliances and the potential for internal conflicts to disrupt malicious operations. For defenders, such feuds provide valuable insights into ransomware tactics, techniques, and procedures, enhancing preparedness against future attacks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Vect 2.0 Ransomware: A Flawed Threat Acting as a Data Wiper
Health Care / Life Sciences6 months ago

Vect 2.0 Ransomware: A Flawed Threat Acting as a Data Wiper

In April 2026, the Vect 2.0 ransomware variant was discovered to contain a critical design flaw that causes it to function as a data wiper rather than traditional ransomware. This flaw affects versions targeting Windows, Linux, and VMware ESXi systems. Specifically, for files larger than 128KB, the malware generates four encryption nonces but only retains the final one, rendering the first three-quarters of each large file permanently unrecoverable. Consequently, victims who pay the ransom cannot retrieve their critical data, as the necessary decryption information is irreversibly lost. ([darkreading.com](https://www.darkreading.com/threat-intelligence/vect-ransomware-wiper-design-error?utm_source=openai)) This incident underscores the evolving nature of cyber threats, where even ransomware can inadvertently become more destructive due to coding errors. Organizations must prioritize robust backup strategies and comprehensive security measures to mitigate such risks. The Vect 2.0 case also highlights the importance of thorough threat analysis and the potential unintended consequences of malware development flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports