Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 150 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1789–1800 / 3490 reports
Change Healthcare Ransomware Attack 2024: Lessons in Cybersecurity
Health Care / Life Sciences6 months ago

Change Healthcare Ransomware Attack 2024: Lessons in Cybersecurity

In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a significant ransomware attack that disrupted billing systems and insurance claims processing across the U.S. healthcare sector. The attackers exploited a server lacking multifactor authentication, leading to the theft of sensitive medical records affecting approximately 190 million individuals. The breach resulted in widespread operational disruptions, including delays in prescription services and financial strain on healthcare providers. ([techcrunch.com](https://techcrunch.com/2024/08/17/how-the-ransomware-attack-at-change-healthcare-went-down-a-timeline/?utm_source=openai)) This incident underscores the critical importance of robust cybersecurity measures in the healthcare industry, especially as ransomware attacks targeting sensitive medical data continue to rise. Organizations must reassess their security protocols to prevent similar breaches and protect patient information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Four New Vulnerabilities to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds Four New Vulnerabilities to Known Exploited Vulnerabilities Catalog

On April 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2024-7399 (Samsung MagicINFO 9 Server Path Traversal), CVE-2024-57726 (SimpleHelp Missing Authorization), CVE-2024-57728 (SimpleHelp Path Traversal), and CVE-2025-29635 (D-Link DIR-823X Command Injection). These vulnerabilities are commonly targeted by malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks from active threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds 4 Exploited Flaws to KEV Catalog, Sets May 2026 Deadline
Government Administration6 months ago

CISA Adds 4 Exploited Flaws to KEV Catalog, Sets May 2026 Deadline

In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities include CVE-2024-57726, a missing authorization flaw in SimpleHelp allowing privilege escalation; CVE-2024-57728, a path traversal issue in SimpleHelp enabling arbitrary file uploads; CVE-2024-7399, a path traversal vulnerability in Samsung MagicINFO 9 Server permitting arbitrary file writes; and CVE-2025-29635, a command injection flaw in D-Link DIR-823X routers allowing remote command execution. Federal agencies are mandated to address these vulnerabilities by May 8, 2026. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by unpatched software in critical infrastructure. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation, especially as some of these vulnerabilities have been linked to ransomware campaigns and botnet deployments in the past.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Adds CVE-2026-39987: Marimo RCE Vulnerability
Computer Software/Engineering6 months ago

CISA Adds CVE-2026-39987: Marimo RCE Vulnerability

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-39987 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation of a critical remote code execution vulnerability in Marimo, a reactive Python notebook application. This flaw, present in versions prior to 0.23.0, allows unauthenticated attackers to gain full pseudo-terminal shell access via the /terminal/ws WebSocket endpoint, enabling arbitrary command execution on the host system. The vulnerability arises from the endpoint's failure to enforce authentication, unlike other WebSocket endpoints in the application. Marimo has addressed this issue in version 0.23.0 by implementing proper authentication checks. Organizations using affected versions are urged to update immediately to mitigate potential risks. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-39987?utm_source=openai)) The inclusion of CVE-2026-39987 in CISA's KEV Catalog underscores the ongoing threat posed by unpatched vulnerabilities in widely used development tools. This incident highlights the critical need for organizations to maintain up-to-date software and implement robust security measures to protect against unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Xiongmai XM530 IP Cameras: CVE-2025-65856
Security/Investigations6 months ago

Critical Vulnerability in Xiongmai XM530 IP Cameras: CVE-2025-65856

In December 2025, a critical authentication bypass vulnerability, identified as CVE-2025-65856, was discovered in Xiongmai XM530 IP cameras running Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. This flaw allows unauthenticated remote attackers to access sensitive device information and live video streams by exploiting the ONVIF implementation, which fails to enforce authentication on 31 critical endpoints. The vulnerability poses significant privacy and security risks to organizations and individuals relying on these surveillance devices. The public release of proof-of-concept exploit code in April 2026 has heightened the urgency for remediation. Despite the severity of the issue, the manufacturer has yet to provide a patch, leaving thousands of devices worldwide vulnerable to potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a privilege escalation flaw in Microsoft Defender. This vulnerability, known as 'BlueHammer,' allows attackers with limited local access to escalate privileges to SYSTEM level due to insufficient access control granularity. The flaw was publicly disclosed by a researcher named 'Chaotic Eclipse' after dissatisfaction with Microsoft's vulnerability disclosure process, leading to the release of exploit details online. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai)) The inclusion of CVE-2026-33825 in the KEV catalog underscores the critical nature of this vulnerability and the urgency for organizations to apply patches. CISA has mandated that Federal Civilian Executive Branch agencies remediate this vulnerability by May 6, 2026, to mitigate the risk of active exploitation. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UNC6692's 'Snow' Malware: A New Threat via Microsoft Teams
Information Technology/IT6 months ago

UNC6692's 'Snow' Malware: A New Threat via Microsoft Teams

In April 2026, the threat group UNC6692 executed a sophisticated social engineering attack targeting enterprise networks. The attackers initiated the campaign by overwhelming victims' email inboxes with spam, creating a sense of urgency. Subsequently, they impersonated IT helpdesk staff via Microsoft Teams, convincing users to install a purported spam-blocking patch. This led to the deployment of a custom malware suite named 'Snow,' comprising components like SnowBelt (a malicious browser extension), SnowGlaze (a tunneling tool), and SnowBasin (a backdoor). These tools facilitated deep network penetration, credential theft, and domain takeover, enabling the exfiltration of sensitive data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/threat-actor-uses-microsoft-teams-to-deploy-new-snow-malware/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted communication platforms and social engineering to bypass traditional security measures. The use of Microsoft Teams as an attack vector highlights the need for heightened vigilance and robust security protocols in enterprise environments to counteract such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BlackFile's Vishing Attacks: A Wake-Up Call for Retail and Hospitality Sectors
Retail Industry6 months ago

BlackFile's Vishing Attacks: A Wake-Up Call for Retail and Hospitality Sectors

In early 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated IT support staff to deceive employees into divulging credentials and one-time passcodes. With these credentials, BlackFile registered their own devices to bypass multi-factor authentication, escalated access to executive accounts, and exfiltrated sensitive data from platforms like Salesforce and SharePoint. The stolen data was then used to pressure victims into paying seven-figure ransoms, with threats of public disclosure on their dark web leak site. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing prevalence of vishing attacks that exploit human vulnerabilities rather than technical system flaws. The success of such social engineering methods emphasizes the need for organizations to enhance employee training and implement robust verification protocols to mitigate similar threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Checkmarx GitHub Repository Data Breach: A Wake-Up Call for CI/CD Security
Computer Software/Engineering6 months ago

Checkmarx GitHub Repository Data Breach: A Wake-Up Call for CI/CD Security

In March 2026, Checkmarx experienced a significant supply chain attack when threat actors compromised its GitHub repositories, injecting credential-stealing malware into GitHub Actions workflows and Docker images. This breach enabled attackers to harvest sensitive developer credentials and infrastructure secrets. Subsequent investigations revealed that data from Checkmarx's GitHub repository was published on the dark web, though the company maintains that customer data is not stored in these repositories. The incident underscores the critical importance of securing software supply chains against sophisticated attacks targeting development infrastructure. This breach highlights a growing trend of supply chain attacks targeting development tools and repositories, emphasizing the need for organizations to implement robust security measures within their CI/CD pipelines. The incident serves as a stark reminder of the potential cascading effects such compromises can have on downstream users and the broader software ecosystem.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unpatched PhantomRPC Flaw in Windows Enables Privilege Escalation
Financial Services6 months ago

Unpatched PhantomRPC Flaw in Windows Enables Privilege Escalation

In April 2026, Kaspersky researchers disclosed 'PhantomRPC,' an unpatched vulnerability in Windows' Remote Procedure Call (RPC) mechanism. This flaw allows attackers with limited local access to deploy malicious RPC servers that impersonate legitimate Windows services. When higher-privileged processes connect to these rogue servers, attackers can escalate their privileges to SYSTEM or administrator levels. The vulnerability arises from how RPC handles connections to unavailable services, permitting any process to register an RPC server on the same endpoint as a legitimate service that is not running. Despite the severity, Microsoft has classified the issue as 'moderate' and has not issued a patch or CVE identifier. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/unpatched-phantomrpc-flaw-windows-privilege-escalation?utm_source=openai)) The disclosure of PhantomRPC underscores the persistent risks associated with architectural vulnerabilities in widely used operating systems. Organizations must proactively implement monitoring and privilege management strategies to mitigate potential exploitation, especially in the absence of official patches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Navigating the New Era of AI-Driven Cyber Threats
Financial Services6 months ago

Navigating the New Era of AI-Driven Cyber Threats

In April 2026, the cybersecurity community faced a significant challenge with the emergence of advanced large language models (LLMs) like Anthropic's Mythos and OpenAI's GPT-5.5. These models enabled threat actors to automate complex cyberattacks, leading to concerns about industrialized, autonomous exploitation across various platforms. Despite these advancements, experts like Ari Herbert-Voss emphasized the continued necessity of human expertise to validate and address the vulnerabilities identified by these AI systems. This incident underscores the evolving threat landscape where AI-driven attacks are becoming more sophisticated and widespread. Organizations must adapt by integrating AI into their defensive strategies while ensuring human oversight to effectively manage and mitigate these emerging threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Claude Mythos: Redefining Vulnerability Discovery in the AI Era
Computer Software/Engineering6 months ago

Claude Mythos: Redefining Vulnerability Discovery in the AI Era

In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability has raised significant concerns about the rapid acceleration of vulnerability discovery and the challenges organizations face in timely remediation. The model's restricted release under Project Glasswing aims to mitigate potential misuse, yet unauthorized access incidents have already been reported, highlighting the pressing need for robust security measures. The emergence of AI-driven vulnerability discovery tools like Mythos signifies a paradigm shift in cybersecurity, compressing exploit timelines and necessitating a reevaluation of existing defense strategies. Organizations must adapt to this new landscape by enhancing their vulnerability management processes and investing in proactive security measures to keep pace with the evolving threat environment.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports