Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 167 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1993–2004 / 3490 reports
WebinarTV's Unauthorized Recording of Zoom Meetings: A 2026 Privacy Breach
Health Care / Life Sciences7 months ago

WebinarTV's Unauthorized Recording of Zoom Meetings: A 2026 Privacy Breach

In March 2026, WebinarTV, a platform claiming to host over 200,000 webinars, was found to be secretly recording publicly accessible Zoom meetings without participants' consent. Utilizing methods such as web scraping and browser extensions with calendar access, WebinarTV joined these meetings, recorded the sessions, and repurposed the content into AI-generated podcasts featuring fictitious hosts. This unauthorized activity exposed sensitive discussions, including private educational sessions and political meetings, leading to significant privacy violations and potential legal repercussions. This incident underscores the growing risks associated with publicly shared virtual meeting links and the exploitation of AI technologies for unauthorized content creation. Organizations must reassess their virtual meeting security protocols to prevent unauthorized access and recording, especially as similar tactics may be adopted by other entities, posing ongoing threats to privacy and data security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Understanding Akira Ransomware: Rapid Encryption Tactics in 2026
Health Care / Life Sciences7 months ago

Understanding Akira Ransomware: Rapid Encryption Tactics in 2026

The Akira ransomware group, active since 2023, has rapidly evolved its attack methods, achieving data encryption within an hour of initial access. By exploiting zero-day vulnerabilities, purchasing exploits from initial access brokers, and targeting VPNs lacking multifactor authentication, Akira has compromised hundreds of victims, amassing at least $245 million in ransom payments by September 2025. Their use of 'intermittent encryption' allows for faster encryption of large files, enhancing operational efficiency. ([cyberscoop.com](https://cyberscoop.com/akira-ransomware-initial-access-to-encryption-in-hours/?utm_source=openai)) This incident underscores the increasing sophistication and speed of ransomware attacks, highlighting the critical need for organizations to implement robust security measures, including regular patching, multifactor authentication, and comprehensive incident response plans. The rise of groups like Akira signifies a shift towards more aggressive and efficient cybercriminal operations, posing significant threats to businesses across various sectors. ([cyberscoop.com](https://cyberscoop.com/akira-ransomware-initial-access-to-encryption-in-hours/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco IMC Authentication Bypass Vulnerability Discovered
Information Technology/IT7 months ago

Critical Cisco IMC Authentication Bypass Vulnerability Discovered

In April 2026, Cisco disclosed a critical vulnerability (CVE-2026-20093) in its Integrated Management Controller (IMC), affecting UCS C-Series and E-Series servers. This flaw allows unauthenticated remote attackers to bypass authentication by sending crafted HTTP requests, enabling them to alter user passwords, including those of Admin accounts, and gain full administrative access to the system. The vulnerability arises from improper handling of password change requests within the IMC's web interface. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn?utm_source=openai)) This incident underscores the critical importance of promptly applying security patches, especially for out-of-band management interfaces that provide extensive control over server hardware. Organizations are urged to update their systems immediately, as no workarounds are available, to prevent potential exploitation that could lead to unauthorized access and control over critical infrastructure. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical RCE Vulnerability in F5 BIG-IP APM: Immediate Action Required
Financial Services7 months ago

Critical RCE Vulnerability in F5 BIG-IP APM: Immediate Action Required

In October 2025, F5 disclosed a vulnerability (CVE-2025-53521) in its BIG-IP Access Policy Manager (APM), initially classified as a denial-of-service issue. In March 2026, this vulnerability was reclassified as a critical remote code execution (RCE) flaw after new information revealed that unauthenticated attackers could exploit it to execute arbitrary code on affected systems. This vulnerability affects BIG-IP APM versions 15.x, 16.x, and 17.x when an access policy is configured on a virtual server. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/?utm_source=openai)) The reclassification underscores the evolving nature of cybersecurity threats and the importance of continuous monitoring and timely patching. Organizations using affected versions of BIG-IP APM are urged to apply the available patches immediately to mitigate the risk of exploitation. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities in Progress ShareFile: Immediate Action Required
Financial Services7 months ago

Critical Vulnerabilities in Progress ShareFile: Immediate Action Required

In early 2026, two critical vulnerabilities were identified in Progress ShareFile's Storage Zones Controller (SZC), a component widely used for secure file sharing. The first, CVE-2026-2699, is an authentication bypass flaw that allows unauthenticated attackers to access restricted configuration pages. The second, CVE-2026-2701, enables remote code execution through malicious file uploads. Exploiting these vulnerabilities in sequence permits attackers to gain unauthorized access and execute arbitrary code on affected systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-progress-sharefile-flaws-can-be-chained-in-pre-auth-rce-attacks/?utm_source=openai)) The disclosure of these vulnerabilities underscores the persistent threat posed by sophisticated cyberattacks targeting enterprise file-sharing solutions. Organizations are urged to promptly apply the security updates provided by Progress to mitigate potential risks associated with these flaws. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-progress-sharefile-flaws-can-be-chained-in-pre-auth-rce-attacks/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Urgent: Patch Critical RCE Vulnerabilities in Progress ShareFile
Financial Services7 months ago

Urgent: Patch Critical RCE Vulnerabilities in Progress ShareFile

In March 2026, security researchers identified two critical vulnerabilities in Progress ShareFile, designated as CVE-2026-2699 and CVE-2026-2701. These flaws, when exploited in tandem, allow unauthenticated attackers to execute remote code by bypassing authentication mechanisms and uploading malicious web shells. Progress promptly addressed these issues by releasing Storage Zone Controller version 5.12.4 on March 10, 2026. Given the approximately 30,000 internet-facing instances of ShareFile, immediate patching is imperative to prevent potential exploitation. This incident underscores the persistent threat posed by chaining multiple vulnerabilities to achieve significant security breaches. Organizations must remain vigilant, ensuring timely updates and comprehensive security assessments to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cisco IMC Vulnerabilities: Authentication Bypass and Command Injection Risks in 2026
Information Technology/IT7 months ago

Cisco IMC Vulnerabilities: Authentication Bypass and Command Injection Risks in 2026

In April 2026, Cisco disclosed two critical vulnerabilities in its Integrated Management Controller (IMC): CVE-2026-20093 and CVE-2026-20094. CVE-2026-20093 is an authentication bypass flaw that allows unauthenticated, remote attackers to gain admin access by exploiting improper handling of password change requests. CVE-2026-20094 is a command injection vulnerability enabling authenticated users with read-only privileges to execute arbitrary commands as the root user due to inadequate input validation. Exploitation of these vulnerabilities could lead to full system compromise, including unauthorized access, data manipulation, and potential service disruptions. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cimc-auth-bypass-AgG2BxTn.html?utm_source=openai)) The disclosure of these vulnerabilities underscores the ongoing risks associated with out-of-band management interfaces. As organizations increasingly rely on such systems for remote administration, ensuring their security becomes paramount. This incident highlights the necessity for regular security assessments, prompt application of patches, and vigilant monitoring to mitigate potential threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AZ Monica Hospital Cyberattack: A Stark Reminder for Healthcare Security
Health Care / Life Sciences7 months ago

AZ Monica Hospital Cyberattack: A Stark Reminder for Healthcare Security

In January 2026, AZ Monica Hospital in Antwerp, Belgium, experienced a significant cyberattack that disrupted its computer systems, leading to the cancellation of at least 70 surgeries and the transfer of seven critical patients to other facilities. The attack also affected patient registration processes and emergency services, compelling the hospital to advise patients to seek care elsewhere. This incident underscores the escalating threat of cyberattacks on healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect patient safety and maintain operational continuity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Axios Supply Chain Attack: A Wake-Up Call for Software Security
Computer Software/Engineering7 months ago

Axios Supply Chain Attack: A Wake-Up Call for Software Security

In late March 2026, attackers compromised the npm account of a primary maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They published two malicious versions, axios@1.14.1 and axios@0.30.4, which included a hidden dependency named 'plain-crypto-js'. This dependency executed a post-install script that deployed a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The RAT connected to a command-and-control server to retrieve platform-specific payloads, performed reconnaissance, and established persistence, with self-deletion capabilities to evade detection. The malicious versions were available for approximately three hours before removal, but the widespread use of Axios means the impact could be significant. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software components are exploited to distribute malware. The sophistication of this attack, including the use of a legitimate maintainer's credentials and the deployment of a cross-platform RAT, highlights the need for enhanced security measures in software development and distribution processes. Organizations must remain vigilant and implement robust monitoring and response strategies to mitigate such risks. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Anthropic's 2026 Source Code Leak: Lessons in Software Security
Computer Software/Engineering7 months ago

Anthropic's 2026 Source Code Leak: Lessons in Software Security

In March 2026, Anthropic, an AI company, inadvertently exposed the complete source code of its proprietary coding assistant, Claude Code. The leak occurred when a routine software update mistakenly included a 60 MB source map file (`cli.js.map`) in the NPM package version 2.1.88, allowing reconstruction of approximately 1,900 files and 500,000 lines of TypeScript code. This exposure revealed internal architectures and unreleased features, providing competitors with insights into Anthropic's development roadmap. The company confirmed that no sensitive customer data or credentials were compromised and attributed the incident to human error in the release packaging process. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai)) This incident underscores the critical importance of stringent internal security and release management practices, especially for organizations handling proprietary and sensitive information. The rapid dissemination of the leaked code across platforms like GitHub highlights the challenges in containing such exposures once they occur. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Google Drive Enhances Security with AI-Powered Ransomware Detection
Information Technology/IT7 months ago

Google Drive Enhances Security with AI-Powered Ransomware Detection

In April 2026, Google announced the general availability of its AI-powered ransomware detection feature for Google Drive, now enabled by default for all paying users. This feature, initially introduced in beta in September 2025, utilizes advanced AI models to monitor file synchronization activities. Upon detecting ransomware-like behavior, it automatically pauses file syncing, alerts users and IT administrators, and provides detailed instructions for restoring uncorrupted files. This proactive approach aims to minimize the impact of ransomware attacks by safeguarding documents stored in Google Drive and facilitating swift recovery processes. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/?utm_source=openai)) The release of this enhanced security feature underscores the growing threat of ransomware attacks targeting cloud storage services. By integrating AI-driven detection mechanisms, Google addresses the need for robust, automated defenses against increasingly sophisticated cyber threats, highlighting the importance of proactive security measures in protecting organizational data assets.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Google Chrome's Dawn WebGPU Zero-Day Vulnerability in 2026
Banking/Mortgage7 months ago

Google Chrome's Dawn WebGPU Zero-Day Vulnerability in 2026

In March 2026, Google identified and patched a critical zero-day vulnerability (CVE-2026-5281) in its Chrome browser, marking the fourth such exploit addressed that year. This flaw resided in Dawn, Chrome's implementation of the WebGPU standard, and was actively exploited in the wild. Attackers leveraged this use-after-free vulnerability to cause browser crashes, data corruption, and potentially execute arbitrary code by enticing users to visit maliciously crafted web content. Google promptly released emergency updates for Windows, macOS, and Linux platforms to mitigate the risk. The recurrence of multiple zero-day vulnerabilities within a short timeframe underscores the persistent targeting of widely-used browsers by threat actors. Organizations and individual users are urged to maintain vigilance by promptly applying security updates and adopting robust cybersecurity practices to mitigate the risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports