Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
AI-Powered Cyberattack Compromises 600 Fortinet Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized generative AI services to compromise over 600 FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known vulnerabilities. Once access was gained, AI-assisted tools were employed to automate reconnaissance, extract configurations, and facilitate lateral movement within the networks. This campaign underscores the evolving threat landscape where AI technologies are being harnessed to amplify the capabilities of less sophisticated attackers, enabling them to execute large-scale intrusions with increased efficiency. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to mitigate such AI-augmented threats.
7 months ago
Kill Chain
CISA Highlights Critical Roundcube Vulnerabilities Amid Active Exploitation
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The first, CVE-2025-49113, is a deserialization flaw allowing remote code execution by authenticated users due to improper validation of the '_from' parameter in 'upload.php'. The second, CVE-2025-68461, is a cross-site scripting vulnerability via the 'animate' tag in SVG documents. Both vulnerabilities have been exploited by threat actors, including nation-state groups like APT28 and Winter Vivern, to steal login credentials and spy on sensitive communications. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent targeting of webmail platforms by sophisticated adversaries. Organizations using Roundcube are urged to apply the latest security patches promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai))
7 months ago
Kill Chain
Predator Spyware's Stealthy Bypass of iOS Recording Indicators
In February 2026, security researchers uncovered that Intellexa's Predator spyware can suppress iOS's camera and microphone recording indicators, allowing covert surveillance without user awareness. By injecting code into SpringBoard, the spyware intercepts sensor activity updates, preventing the green and orange dots from appearing when the camera or microphone is active. This technique requires prior full device compromise, including kernel-level access, and does not exploit new iOS vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/?utm_source=openai)) This discovery highlights the evolving sophistication of commercial spyware and underscores the importance of maintaining up-to-date device security measures. Users should be aware that visual indicators alone may not reliably signal unauthorized access to device sensors, emphasizing the need for comprehensive security practices.
7 months ago
Kill Chain
AI-Assisted Cyber Attack Compromises 600+ FortiGate Devices in 2026
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor exploited exposed management ports and weak credentials to compromise over 600 FortiGate devices across 55 countries. Utilizing commercial generative AI tools, the attacker automated scanning for vulnerable devices and executed authentication attempts, leading to unauthorized access and potential data exfiltration. This incident underscores the growing trend of cybercriminals leveraging AI to scale operations, enabling even low-skilled actors to conduct widespread attacks. Organizations must prioritize securing management interfaces, enforcing strong authentication mechanisms, and monitoring for unauthorized access to mitigate such threats.
7 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that use static replicas of login pages, Starkiller employs a headless Chrome browser within a Docker container to proxy live login pages of targeted brands such as Microsoft, Google, and Apple. This method allows attackers to capture user credentials, including multi-factor authentication (MFA) codes, in real-time by acting as a man-in-the-middle between the victim and the legitimate site. The platform offers features like keylogging, session token theft, geo-tracking, and real-time session monitoring, all accessible through an intuitive dashboard that lowers the technical barrier for cybercriminals. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/?utm_source=openai)) The emergence of Starkiller signifies a significant escalation in phishing tactics, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling. Its ability to bypass MFA protections and its user-friendly interface make it a potent tool for attackers, necessitating a shift in defensive strategies toward behavioral detection and identity-aware analysis to effectively counter such advanced threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa?utm_source=openai))
7 months ago
Kill Chain
React2Shell Exploitation 2025: A Wake-Up Call for Web Security
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via crafted HTTP requests. Within hours of disclosure, state-sponsored threat actors, including Chinese groups Earth Lamia and Jackpot Panda, as well as North Korean operatives, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The widespread use of React in web applications amplified the impact, leading to numerous system compromises across various sectors. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The rapid exploitation of React2Shell underscores the increasing speed at which threat actors weaponize newly disclosed vulnerabilities. Organizations are urged to prioritize timely patching and enhance monitoring to mitigate risks associated with such critical flaws.
7 months ago
Kill Chain
AI-Powered Cyberattack Compromises Hundreds of FortiGate Devices Globally
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor leveraged commercial generative AI services to compromise over 600 FortiGate devices across more than 55 countries. The attackers exploited exposed management ports and weak, single-factor authentication credentials, without utilizing any known FortiGate vulnerabilities. This campaign enabled the threat actor to extract full device configurations, including credentials and network topology information, facilitating further post-exploitation activities such as Active Directory compromise and credential harvesting. ([aws.amazon.com](https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools lower the technical barrier for cybercriminals, allowing even those with limited skills to execute large-scale attacks. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to detect and respond to such AI-augmented threats.
7 months ago
Kill Chain
Roundcube 2025 Remote Code Execution Vulnerability
In June 2025, a critical vulnerability (CVE-2025-49113) was identified in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. This flaw allowed authenticated users to execute arbitrary code on the server due to improper validation of the '_from' parameter in the 'upload.php' script, leading to PHP object deserialization. Exploitation of this vulnerability could result in complete server compromise, unauthorized access to sensitive email data, and potential lateral movement within the network. ([feedly.com](https://feedly.com/cve/CVE-2025-49113?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation and prompt patch management. Organizations using affected versions of Roundcube Webmail are urged to upgrade to the latest versions to mitigate potential exploitation risks.
7 months ago
Kill Chain
UMMC Ransomware Attack Disrupts Healthcare Services in Mississippi
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack that led to the closure of all its clinics statewide and the cancellation of elective procedures. The cyberattack compromised multiple IT systems, including the Epic electronic medical records platform, necessitating the implementation of downtime procedures to maintain patient care. Emergency services remained operational, but the disruption affected numerous outpatient services and appointments. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect sensitive patient data and ensure the continuity of medical services.
7 months ago
Kill Chain
BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks
In early February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted requests to vulnerable endpoints. Despite the release of patches, active exploitation began almost immediately, with threat actors deploying ransomware and exfiltrating data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, emphasizing the urgency for organizations to apply the necessary updates. The rapid exploitation of CVE-2026-1731 underscores a concerning trend where attackers swiftly leverage newly disclosed vulnerabilities to launch ransomware campaigns. This incident highlights the critical need for organizations to implement robust patch management processes and maintain vigilant monitoring to detect and respond to such threats promptly.
7 months ago
Kill Chain
Cline CLI Supply Chain Attack: Lessons in Software Security
In February 2026, the Cline CLI, a widely used AI coding assistant, was compromised through a supply chain attack. An unauthorized party exploited a stolen npm publish token to release version 2.3.0 of Cline CLI, which included a modified package.json file. This modification added a postinstall script that silently installed OpenClaw, an unrelated open-source package, on developers' systems upon installation. The malicious version was available for approximately eight hours before being deprecated, during which it was downloaded around 4,000 times. The Cline team responded by revoking the compromised token, publishing a corrected version (2.4.0), and enhancing their release pipeline security. This incident underscores the escalating threat of supply chain attacks targeting developer tools. The unauthorized installation of OpenClaw, while not inherently malicious, highlights the potential for more harmful payloads in future attacks. Organizations are urged to audit their development environments and enforce stringent security measures to mitigate such risks.
7 months ago
Kill Chain
BeyondTrust CVE-2026-1731 Exploitation: A 2026 Cybersecurity Incident
In February 2026, a critical vulnerability (CVE-2026-1731) in BeyondTrust's Remote Support (RS) and Privileged Remote Access (PRA) products was actively exploited by threat actors. This pre-authentication remote code execution flaw allowed attackers to execute operating system commands as the site user, leading to unauthorized access, data exfiltration, and service disruptions. The attacks targeted sectors including financial services, legal services, high technology, higher education, wholesale and retail, and healthcare across multiple countries. The exploitation involved deploying web shells, backdoors, and remote management tools, facilitating lateral movement and data theft. Notably, malware such as VShell and Spark RAT were utilized. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities catalog to include CVE-2026-1731, confirming its use in ransomware campaigns.
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports