Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 149 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1777–1788 / 3490 reports
DPRK-Linked Supply Chain Attack on Axios npm Package in 2026
Computer Software/Engineering6 months ago

DPRK-Linked Supply Chain Attack on Axios npm Package in 2026

In March 2026, North Korean state-sponsored hackers, identified as UNC1069, executed a sophisticated supply chain attack by compromising the widely-used JavaScript library Axios. The attackers gained access to the maintainer's npm account and published malicious versions 1.14.1 and 0.30.4, which included a remote access trojan (RAT). This malware granted the attackers control over infected systems, potentially leading to credential theft and persistent access. The malicious versions were available for approximately three hours before detection and removal, during which time they were downloaded millions of times, posing a significant risk to developers and organizations worldwide. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations must implement stringent monitoring and verification processes to safeguard against such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Understanding and Mitigating AI-Driven Cyberattacks
Financial Services6 months ago

Understanding and Mitigating AI-Driven Cyberattacks

In February 2026, cybersecurity researchers identified a significant evolution in attack methodologies: threat actors are now leveraging custom AI systems to automate and expedite the cyber kill chain. This advancement enables attackers to autonomously map Active Directory structures and obtain Domain Admin credentials within minutes, drastically reducing the time required for system compromise. The integration of AI into cyberattacks has rendered traditional defensive workflows insufficient, as these automated systems can adapt and execute complex attacks with unprecedented speed and precision. This development underscores a critical shift in the cybersecurity landscape, where AI-enhanced attacks are no longer theoretical but a present reality. Organizations must recognize the urgency of adapting their security strategies to counteract these sophisticated threats. The rapid adoption of AI by malicious actors necessitates a reevaluation of existing defenses to ensure they are capable of mitigating the risks posed by autonomous cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes
Computer Software/Engineering6 months ago

Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes

In April 2026, Mozilla collaborated with Anthropic to utilize the advanced AI model, Claude Mythos, for a comprehensive security audit of Firefox. This partnership led to the identification and remediation of 271 vulnerabilities in Firefox 150, marking a significant advancement in AI-assisted cybersecurity. The vulnerabilities ranged from minor issues to critical flaws, all of which were addressed in the latest release. This initiative underscores the potential of AI in enhancing software security by rapidly detecting and mitigating vulnerabilities that might elude traditional methods. The success of this collaboration highlights a pivotal shift in cybersecurity, where defenders can leverage AI to gain a decisive advantage over potential threats. As AI tools become more sophisticated, their integration into security protocols is expected to become standard practice, offering a proactive approach to threat detection and resolution.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation
Computer Software/Engineering6 months ago

LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation

A high-severity Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-33626 with a CVSS score of 7.5, was discovered in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs). This flaw resides in the vision-language module's `load_image()` function, which fetches arbitrary URLs without validating internal or private IP addresses, potentially allowing attackers to access cloud metadata services, internal networks, and sensitive resources. The vulnerability affects all versions up to 0.12.2 and was patched in version 0.12.3. Notably, within 13 hours of its public disclosure, the vulnerability was actively exploited in the wild, with attackers targeting AWS Instance Metadata Service (IMDS) and Redis instances, testing egress with out-of-band DNS callbacks, and performing port scans on the loopback interface. This rapid exploitation underscores the critical need for prompt vulnerability management and patching practices. The incident highlights a concerning trend where threat actors swiftly weaponize newly disclosed vulnerabilities, particularly in AI infrastructure components, emphasizing the importance of proactive security measures and continuous monitoring to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Project Glasswing: AI's Role in Transforming Cybersecurity
Information Technology/IT6 months ago

Project Glasswing: AI's Role in Transforming Cybersecurity

In April 2026, Anthropic launched Project Glasswing, an initiative leveraging its advanced AI model, Claude Mythos Preview, to identify and remediate critical software vulnerabilities. Collaborating with major tech companies like AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, and Palo Alto Networks, the project uncovered thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug. This initiative underscores the shift from traditional enumeration-based security tools to AI-driven analysis capable of understanding code intent and relationships, thereby identifying flaws that eluded conventional methods. The significance of Project Glasswing lies in its demonstration of AI's potential to revolutionize cybersecurity by proactively detecting and addressing vulnerabilities before they can be exploited. This proactive approach is crucial in an era where attackers increasingly leverage sophisticated tools, including AI, to identify and exploit security weaknesses. Organizations must adapt to this evolving threat landscape by integrating AI-driven security solutions to enhance their defensive capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Powered Phishing Attacks Surge in 2026
Financial Services6 months ago

AI-Powered Phishing Attacks Surge in 2026

In the first quarter of 2026, AI-powered phishing attacks have surged, becoming the primary method for initial access in cyber incidents. According to Cisco Talos' "IR Trends Q1 2026" report, over 35% of compromises investigated were initiated through sophisticated phishing campaigns. These attacks often employ AI tools like SoftrAI to create convincing credential harvesting pages targeting Microsoft Exchange and Outlook Web Access accounts. The public administration and healthcare sectors have been particularly affected, each accounting for 24% of the targeted incidents. ([blog.talosintelligence.com](https://blog.talosintelligence.com/ir-trends-q1-2026/?utm_source=openai)) This trend underscores the evolving threat landscape where cybercriminals leverage AI to enhance the effectiveness and scale of their phishing campaigns. Organizations must adapt by implementing robust multi-factor authentication, enhancing employee training to recognize advanced phishing attempts, and deploying AI-driven security solutions to detect and mitigate these sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Tropic Trooper APT's Unconventional Attack on Home Routers in Japan
Telecommunications6 months ago

Tropic Trooper APT's Unconventional Attack on Home Routers in Japan

In April 2026, the Chinese state-sponsored advanced persistent threat (APT) group known as Tropic Trooper expanded its cyberespionage operations to target individuals in Japan, Taiwan, and South Korea. The group employed unconventional tactics, including compromising victims' home Wi-Fi routers to deliver malware through tampered software updates. This method involved DNS hijacking, redirecting legitimate update requests to malicious servers, resulting in the deployment of tools like the Cobalt Strike beacon. The campaign also introduced new malware families, such as DaveShell and Donut loader, indicating a rapid evolution in Tropic Trooper's toolset and an expansion of their operational scope. ([darkreading.com](https://www.darkreading.com/threat-intelligence/tropic-trooper-apt-takes-aim-home-routers-japanese-targets?utm_source=openai)) This incident underscores the increasing sophistication of APT groups in targeting personal devices and home networks, highlighting the necessity for enhanced security measures beyond traditional corporate environments. Organizations and individuals must remain vigilant against evolving cyber threats that exploit less conventional attack vectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Fast16: The 2005 Cyber Sabotage Framework
Telecommunications6 months ago

Unveiling Fast16: The 2005 Cyber Sabotage Framework

In April 2026, SentinelOne researchers uncovered 'fast16,' a sophisticated malware framework dating back to 2005, predating the infamous Stuxnet by five years. Designed for industrial sabotage, fast16 targeted high-precision engineering and physics simulation software, subtly corrupting mathematical calculations to induce errors in critical applications. The malware's discovery reveals an early instance of state-sponsored cyber sabotage aimed at undermining scientific and engineering outputs without immediate detection. ([wired.com](https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/?utm_source=openai)) The revelation of fast16 underscores the long-standing and evolving nature of cyber threats targeting critical infrastructure. It highlights the necessity for organizations to continuously assess and fortify their cybersecurity measures against both historical and emerging threats, emphasizing the importance of vigilance in protecting sensitive computational processes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FIRESTARTER Backdoor: A Persistent Threat to Cisco Firepower Devices
Government Administration6 months ago

FIRESTARTER Backdoor: A Persistent Threat to Cisco Firepower Devices

In September 2025, a U.S. federal civilian agency's Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised by the FIRESTARTER backdoor. This malware exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access, allowing threat actors to maintain persistent control over the device. Notably, FIRESTARTER's persistence mechanism enabled it to survive firmware updates and device reboots, rendering standard patching ineffective. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting critical infrastructure. The ability of malware like FIRESTARTER to persist post-patching highlights the necessity for organizations to implement comprehensive security measures beyond regular updates, including continuous monitoring and advanced threat detection capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Firestarter Malware: A Persistent Threat to Cisco Firewalls in 2026
Government Administration6 months ago

Firestarter Malware: A Persistent Threat to Cisco Firewalls in 2026

In April 2026, cybersecurity agencies in the U.S. and U.K. identified a persistent malware named Firestarter targeting Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. The threat actor, tracked as UAT-4356, exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access, deploying the Line Viper malware followed by Firestarter to maintain access even after patches were applied. Firestarter achieves persistence by integrating into the core Cisco ASA process, LINA, and survives reboots, firmware updates, and security patches. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting critical infrastructure. Organizations must prioritize timely patching, implement robust monitoring, and adopt comprehensive security measures to mitigate such persistent threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Zimbra CVE-2025-48700 XSS Vulnerability Exploitation in 2026
Government Administration6 months ago

Zimbra CVE-2025-48700 XSS Vulnerability Exploitation in 2026

In April 2026, over 10,000 Zimbra Collaboration Suite (ZCS) servers were found vulnerable to active exploitation of a cross-site scripting (XSS) flaw, identified as CVE-2025-48700. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript within a user's session by sending crafted emails, potentially leading to unauthorized access to sensitive information. Despite patches released in June 2025, a significant number of servers remained unpatched, exposing organizations to ongoing attacks. The continued exploitation of CVE-2025-48700 underscores the critical importance of timely patch management and vigilance against XSS vulnerabilities. Organizations must prioritize updating their systems and implementing robust security measures to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
In-Depth Analysis of the 2026 Axios npm Supply Chain Attack
Computer Software/Engineering6 months ago

In-Depth Analysis of the 2026 Axios npm Supply Chain Attack

In March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They released two malicious versions of the package—axios@1.14.1 and axios@0.30.4—which included a trojan-laden dependency named 'plain-crypto-js'. This rogue package executed a post-installation script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malware connected to a command-and-control server, deployed system-specific payloads, and erased its tracks to evade detection. The malicious versions were available for approximately two to three hours before being removed from the npm registry. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations are urged to implement stringent access controls, conduct regular audits of dependencies, and monitor for unusual activity to mitigate the risks associated with such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports