Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 165 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1969–1980 / 3490 reports
GrafanaGhost: Unveiling the Critical AI Prompt Injection Vulnerability in Grafana
Information Technology/IT7 months ago

GrafanaGhost: Unveiling the Critical AI Prompt Injection Vulnerability in Grafana

In April 2026, security researchers at Noma Security disclosed a critical vulnerability in Grafana, termed 'GrafanaGhost.' This exploit enables attackers to silently exfiltrate sensitive data by circumventing Grafana's AI defenses through prompt injection techniques. The attack does not require user interaction or authentication; it leverages crafted URLs to inject hidden instructions that Grafana's AI processes, leading to unauthorized data transmission to attacker-controlled servers. The vulnerability affects Grafana instances widely used for monitoring real-time financial metrics, infrastructure health data, and customer records, posing significant risks to enterprise data security. This incident underscores the escalating threat of AI prompt injection attacks, where adversaries manipulate AI systems to perform unintended actions. As AI integration in enterprise environments grows, such vulnerabilities highlight the urgent need for robust AI-specific security measures to prevent data breaches and maintain system integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Storm-1175's Rapid Exploitation of Zero-Day Vulnerabilities in Medusa Ransomware Attacks
Health Care / Life Sciences7 months ago

Storm-1175's Rapid Exploitation of Zero-Day Vulnerabilities in Medusa Ransomware Attacks

In April 2026, Microsoft identified Storm-1175, a China-based cybercriminal group, exploiting zero-day vulnerabilities to deploy Medusa ransomware. The group rapidly transitioned from initial access to data exfiltration and ransomware deployment, often within 24 hours. They targeted sectors including healthcare, education, professional services, and finance across the U.S., U.K., and Australia. Storm-1175 utilized tools like PowerShell, PsExec, and remote monitoring software to establish persistence, conduct reconnaissance, and move laterally within networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/?utm_source=openai)) This incident underscores the increasing sophistication and speed of ransomware attacks, highlighting the critical need for organizations to promptly patch vulnerabilities and enhance their cybersecurity defenses to mitigate such rapidly evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BKA Unmasks REvil Leaders Behind 130 German Ransomware Attacks
Financial Services7 months ago

BKA Unmasks REvil Leaders Behind 130 German Ransomware Attacks

In April 2026, Germany's Federal Criminal Police Office (BKA) unmasked the identities of two key figures associated with the REvil ransomware-as-a-service (RaaS) operation. Daniil Maksimovich Shchukin, known online as 'UNKN,' and Anatoly Sergeevitsch Kravchuk were linked to 130 ransomware attacks across Germany, resulting in over €35.4 million in damages. The REvil group, active from 2019 to 2021, targeted high-profile organizations, demanding substantial ransoms in exchange for decrypting and not leaking data. ([thehackernews.com](https://thehackernews.com/2026/04/bka-identifies-revil-leaders-behind-130.html?utm_source=openai)) This revelation underscores the persistent threat posed by sophisticated ransomware groups and highlights the importance of international cooperation in cybercrime investigations. Organizations must remain vigilant, as the tactics employed by groups like REvil continue to evolve, posing significant risks to global cybersecurity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GPUBreach 2026: Unveiling the Latest NVIDIA GPU Rowhammer Attack
Computer Hardware7 months ago

GPUBreach 2026: Unveiling the Latest NVIDIA GPU Rowhammer Attack

In April 2026, researchers from the University of Toronto unveiled 'GPUBreach,' a sophisticated attack leveraging Rowhammer techniques on NVIDIA GPUs equipped with GDDR6 memory. This method enables unprivileged CUDA kernels to induce bit-flips in GPU page tables, granting arbitrary GPU memory access. Exploiting vulnerabilities in NVIDIA drivers, attackers can escalate privileges to achieve full system compromise, even with Input-Output Memory Management Unit (IOMMU) protections active. The attack was demonstrated on NVIDIA RTX A6000 GPUs, commonly used in AI development and training workloads. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-gpubreach-attack-enables-system-takeover-via-gpu-rowhammer/?utm_source=openai)) The emergence of GPUBreach underscores a significant evolution in hardware-based attacks, highlighting the necessity for robust hardware security measures. As adversaries increasingly exploit hardware vulnerabilities, organizations must prioritize comprehensive security strategies that encompass both software and hardware components to mitigate such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the BlueHammer Windows Zero-Day Exploit
Financial Services7 months ago

Understanding the BlueHammer Windows Zero-Day Exploit

In April 2026, a security researcher operating under the alias 'Chaotic Eclipse' publicly disclosed a Windows zero-day vulnerability named 'BlueHammer.' This local privilege escalation flaw allows attackers to gain SYSTEM-level access by exploiting a combination of time-of-check to time-of-use (TOCTOU) and path confusion vulnerabilities. The researcher released proof-of-concept (PoC) code on GitHub, expressing dissatisfaction with Microsoft's handling of the disclosure process. As of the disclosure date, no official patch has been released, leaving systems vulnerable to potential exploitation. The public release of the BlueHammer exploit underscores the ongoing challenges in vulnerability disclosure and patch management. Organizations must remain vigilant, as unpatched zero-day vulnerabilities can be rapidly weaponized by threat actors, leading to significant security breaches and operational disruptions.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Qilin and Warlock Ransomware Utilize BYOVD to Disable EDR Tools
Health Care / Life Sciences7 months ago

Qilin and Warlock Ransomware Utilize BYOVD to Disable EDR Tools

In April 2026, cybersecurity researchers from Cisco Talos and Trend Micro identified that the Qilin and Warlock ransomware groups are employing the 'Bring Your Own Vulnerable Driver' (BYOVD) technique to disable endpoint detection and response (EDR) tools on compromised systems. This method involves deploying malicious DLLs, such as 'msimg32.dll,' to initiate multi-stage infection chains that terminate over 300 EDR drivers from various security vendors. By leveraging vulnerable drivers like 'rwdrv.sys' and 'hlpdrv.sys,' these ransomware groups effectively neutralize security defenses, facilitating the encryption of files and demanding ransoms from victims. ([thehackernews.com](https://thehackernews.com/2026/04/qilin-and-warlock-ransomware-use.html?utm_source=openai)) The adoption of BYOVD tactics by Qilin and Warlock underscores a significant evolution in ransomware strategies, highlighting the increasing sophistication of threat actors in circumventing traditional security measures. This trend necessitates enhanced vigilance and the implementation of advanced security protocols to detect and mitigate such evasive techniques.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
North Korean Hackers Compromise Axios JavaScript Library in 2026 Supply Chain Attack
Financial Services7 months ago

North Korean Hackers Compromise Axios JavaScript Library in 2026 Supply Chain Attack

In late March 2026, the widely-used JavaScript library Axios, with over 100 million weekly downloads, was compromised in a sophisticated supply chain attack. Threat actors, identified as the North Korean group UNC1069, gained access to a maintainer's npm account and released two malicious versions of the package: axios@1.14.1 and axios@0.30.4. These versions included a trojan-laden dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malware connected to a command-and-control server, retrieved system-specific payloads, and erased its tracks to evade detection. The malicious packages were available for approximately three hours before removal, potentially affecting numerous developers and organizations. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, where trusted software components are weaponized to distribute malware. The rapid detection and removal of the compromised packages highlight the importance of vigilant monitoring and swift response mechanisms. Organizations are urged to review their software supply chain security practices, implement robust access controls, and ensure the integrity of their development environments to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
TeamPCP's 2026 Supply Chain Attack on LiteLLM: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

TeamPCP's 2026 Supply Chain Attack on LiteLLM: A Wake-Up Call for Open-Source Security

In March 2026, the threat group TeamPCP executed a sophisticated supply chain attack targeting LiteLLM, a widely used Python package facilitating unified access to various large language models. By compromising LiteLLM's PyPI repository credentials—initially obtained through a prior breach of the Trivy security scanner—TeamPCP published malicious versions 1.82.7 and 1.82.8. These versions contained malware designed to harvest sensitive credentials, including SSH keys, cloud access tokens, and Kubernetes secrets, and to establish persistent backdoors within affected systems. The compromised packages were available for approximately three hours before removal, during which they were downloaded extensively, potentially impacting thousands of systems. This incident underscores the escalating threat posed by supply chain attacks, particularly those targeting widely adopted open-source tools integral to AI and cloud infrastructures. The rapid propagation and depth of access achieved by TeamPCP highlight the critical need for organizations to implement stringent security measures within their software development pipelines and to maintain vigilant monitoring of third-party dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations
Government Administration7 months ago

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations

In March 2026, an Iran-linked threat actor executed a coordinated password-spraying campaign targeting Microsoft 365 environments across Israel and the United Arab Emirates. The attacks occurred in three waves on March 3, 13, and 23, affecting over 300 organizations in Israel and more than 25 in the UAE. Primary targets included municipalities, technology firms, transportation, and healthcare sectors. Attackers utilized rotating Tor exit nodes for scanning and employed VPN services geolocated within Israel to bypass geo-fencing restrictions. Once valid credentials were obtained, they accessed and exfiltrated sensitive data, including personal emails. ([thehackernews.com](https://thehackernews.com/2026/04/iran-linked-password-spraying-campaign.html?utm_source=openai)) This incident underscores the escalating cyber threats in the Middle East, particularly those linked to nation-state actors. The use of password-spraying techniques highlights the critical need for robust authentication measures and vigilant monitoring to detect and mitigate unauthorized access attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Germany Unmasks Leader of REvil and GandCrab Ransomware Groups
Financial Services7 months ago

Germany Unmasks Leader of REvil and GandCrab Ransomware Groups

In April 2026, German authorities identified 31-year-old Russian national Daniil Maksimovich Shchukin as 'UNKN,' the alleged leader of the notorious ransomware groups GandCrab and REvil. Between 2019 and 2021, Shchukin and his associate, 43-year-old Anatoly Sergeevitsch Kravchuk, reportedly executed at least 130 cyberattacks in Germany, extorting nearly €2 million and causing over €35 million in economic damages. These groups pioneered the double extortion tactic, demanding ransom for decrypting systems and additional payment to prevent data leaks. This revelation underscores the persistent threat posed by sophisticated ransomware operations and highlights the importance of international collaboration in combating cybercrime. Organizations must remain vigilant, as the identification of such key figures does not eliminate the risk of future attacks employing similar tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
UAT-10608's Exploitation of React2Shell: A Wake-Up Call for Cybersecurity
Computer Software/Engineering7 months ago

UAT-10608's Exploitation of React2Shell: A Wake-Up Call for Cybersecurity

In early April 2026, a threat cluster identified as UAT-10608 launched a global credential theft campaign targeting public-facing Next.js applications vulnerable to the React2Shell flaw (CVE-2025-55182). Exploiting this pre-authentication remote code execution vulnerability, attackers deployed an automated tool named 'NEXUS Listener' to exfiltrate credentials, SSH keys, cloud tokens, and environment secrets from compromised systems. This campaign resulted in the compromise of at least 766 hosts across multiple industries and geographic regions. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/automated-credential-harvesting-campaign-react2shell?utm_source=openai)) The React2Shell vulnerability, disclosed in December 2025, allows unauthenticated attackers to execute arbitrary code on servers running vulnerable versions of React Server Components. Despite the availability of patches, many organizations have yet to update their systems, leaving them susceptible to such attacks. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/?msockid=3159dd8396d16eca0085cb7697616f99&utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Fortinet FortiClient EMS Vulnerability: Immediate Action Required
Government Administration7 months ago

Fortinet FortiClient EMS Vulnerability: Immediate Action Required

In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests. The vulnerability has been actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise customers to update to version 7.4.7. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The rapid exploitation of CVE-2026-35616 underscores the increasing trend of attackers targeting endpoint management solutions to gain unauthorized access and control over enterprise networks. Organizations must prioritize timely patching and robust access controls to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports