Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 17 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 193–204 / 3490 reports
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
Computer Software/Engineering3 weeks ago

curl's Critical HTTP/2 Vulnerability: When Clients Become Targets

A critical use-after-free vulnerability (CVE-2026-92392) in curl versions 8.12.0 through 8.22.0 allows malicious servers to corrupt client memory during HTTP/2 file uploads, potentially leading to remote code execution. The flaw occurs when a malicious server stalls an upload, resets the stream while keeping the connection open, causing curl to mishandle memory references during retry operations. While exploitation requires precise knowledge of the client's build and memory layout, making successful attacks unlikely, the vulnerability affects both the curl command-line tool and libcurl library used by numerous applications. The curl project expedited their release cycle to ship version 8.23.0 with a fix on October 14, 2026. This vulnerability represents a significant escalation in client-side attack vectors, demonstrating how AI-powered vulnerability research is uncovering complex memory corruption flaws in widely-deployed networking libraries. With HTTP/2 becoming the default protocol for most applications, such vulnerabilities pose substantial risks to enterprise software supply chains and require immediate attention from security teams.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Financial Services3 weeks ago

Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing

Microsoft uncovered a sophisticated Chinese-language cybercriminal ecosystem centered around YAM Store (Storm-3119), an initial access broker selling fraudulently obtained Microsoft 365 and Google cloud environments to phishing kit operators. The operation, tracked as Storm-2990, includes three major phishing kits (CoGUI, Haozi, and Iron Man System) that have facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide since January 2026. The threat actors primarily targeted healthcare, financial services, wholesale distribution, and IT sectors across Japan, the United States, Australia, and India, using sophisticated evasion techniques including geofencing, anti-detection configurations, and real-time victim interaction through Telegram bots. This incident highlights the evolving threat landscape where cybercriminal infrastructure has become commoditized through phishing-as-a-service platforms, significantly lowering barriers to entry for less skilled attackers. The discovery comes amid increased regulatory scrutiny on cloud security and the growing sophistication of social engineering attacks targeting multi-factor authentication bypass techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Security Flaws Found in 25 Popular Package Managers
Critical Security Flaws Found in 25 Popular Package Managers
Computer Software/Engineering3 weeks ago

Critical Security Flaws Found in 25 Popular Package Managers

A comprehensive security analysis of 25 popular package managers revealed widespread vulnerabilities in supply chain integrity protection. Trail of Bits researchers discovered that fewer than half use lockfiles that check for tampering by default, and only two package managers verify the integrity of every downloaded package. The study exposed critical weaknesses including unencrypted HTTP connections in cpanminus, insufficient cryptographic hash validation across multiple platforms, and missing signature verification in most systems. These vulnerabilities could allow malicious package repositories to inject compromised code into legitimate software dependencies, potentially affecting millions of applications worldwide. This research highlights the urgent need for stronger package manager security as supply chain attacks continue to evolve and target increasingly sophisticated infrastructure components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical OCI Identity Domains Vulnerability: When Cloud Authorization Models Collide
Critical OCI Identity Domains Vulnerability: When Cloud Authorization Models Collide
Computer Software/Engineering3 weeks ago

Critical OCI Identity Domains Vulnerability: When Cloud Authorization Models Collide

In March 2026, security researchers at NetSPI discovered a critical permission bypass vulnerability in Oracle Cloud Infrastructure (OCI) Identity Domains that allowed lower-privileged User Manager roles to escalate privileges and create API keys for Identity Domain Administrators. The vulnerability exploited a disconnect between two separate authorization models within OCI - traditional IAM policies and Identity Domain application roles - where different API endpoints failed to consistently enforce the same security boundaries. This allowed attackers with minimal User Manager permissions to gain full administrative control over identity domains, bypassing intended role separation controls. Oracle patched the vulnerability in June 2026 after a three-month disclosure process. This incident highlights the growing complexity of cloud identity and access management systems, where multiple authorization models can create unexpected privilege escalation paths. As organizations increasingly adopt multi-cloud strategies and complex identity architectures, understanding the intersection of different permission systems becomes critical for preventing similar bypass vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign
UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign
Financial Services3 weeks ago

UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign

In October 2024, threat actor UTA0576 exploited a zero-day vulnerability chain (CVE-2026-104935) in Ivanti Connect Secure VPN appliances, achieving authentication bypass and remote code execution. The attackers focused on credential theft, Active Directory metadata extraction, and network reconnaissance across a limited number of customer environments. Ivanti had discovered portions of the vulnerability during internal security checks in June but delayed patching until the regular release cycle, allowing attackers to weaponize the flaw before remediation. This incident highlights the persistent targeting of VPN and edge devices as initial compromise vectors, with CISA adding 36 Ivanti vulnerabilities to its Known Exploited Vulnerabilities catalog since 2021. The attack demonstrates the critical importance of timely security updates for internet-facing infrastructure and the need for robust monitoring of edge device compromise indicators.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Disrupts Billion-Message Storm-2990 Chinese Phishing Empire
Microsoft Disrupts Billion-Message Storm-2990 Chinese Phishing Empire
Health Care / Life Sciences3 weeks ago

Microsoft Disrupts Billion-Message Storm-2990 Chinese Phishing Empire

In early 2025, Microsoft collaborated with Japanese authorities and cybersecurity partners to dismantle a massive Chinese-language phishing kit ecosystem tracked as Storm-2990. The operation involved interconnected services including YAM Store, CoGUI, and Iron Man that delivered over 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. The cybercriminal network primarily targeted healthcare, financial services, logistics, and IT sectors in the United States and Japan, selling customized phishing kits that enabled credential theft, financial fraud, and device code authentication abuse. This incident highlights the growing sophistication of transnational cybercriminal operations and the increasing threat of supply-chain style cybercrime services. The emergence of organized phishing-as-a-service ecosystems represents a significant shift in threat landscape maturity, where criminal groups operate like legitimate businesses with specialized roles and infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SlugFest Attack Exposes Critical Gap in npm Trusted Publishing Security
SlugFest Attack Exposes Critical Gap in npm Trusted Publishing Security
Computer Software/Engineering3 weeks ago

SlugFest Attack Exposes Critical Gap in npm Trusted Publishing Security

In October 2026, GitHub addressed a critical vulnerability in npm's trusted publishing mechanism discovered by Bloom Security researchers. The flaw, dubbed 'SlugFest,' allowed attackers to hijack over 1,500 npm packages downloaded more than 10 million times by exploiting repository slug reclaiming. Attackers could claim abandoned GitHub repository names and inherit trusted publishing configurations, enabling them to push malicious versions of legitimate packages without credential theft. The attack vector particularly threatened AI-driven development environments where autonomous agents automatically pull dependencies. This incident highlights the growing sophistication of supply chain attacks targeting modern development workflows, especially as AI agents become prevalent in software development. The vulnerability exploited the gap between human-readable identifiers and immutable repository IDs, demonstrating how automation and AI-assisted development can amplify traditional supply chain risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise
UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise
Government Administration3 weeks ago

UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise

In October 2026, threat actor UTA0576 exploited a chain of three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root access. The attack targeted fully patched systems running version 22.8R2.4, combining authentication bypass and remote code execution flaws (CVE-2026-104935) with an unpatched privilege escalation vulnerability. The attacker stole LDAP credentials, performed Active Directory reconnaissance, and executed password-spraying attacks while evading detection through memory-only modifications and configuration restoration techniques. This incident highlights the continued targeting of VPN infrastructure by sophisticated threat actors, reflecting the ongoing trend of chaining zero-day exploits against critical network access points. With only two of the three vulnerabilities patched and active exploitation confirmed by CISA, organizations face immediate risk to their remote access infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical SAP Cloud SDK Vulnerability Exposes OAuth2 Credentials in Multi-Tenant Environments
Critical SAP Cloud SDK Vulnerability Exposes OAuth2 Credentials in Multi-Tenant Environments
Computer Software/Engineering3 weeks ago

Critical SAP Cloud SDK Vulnerability Exposes OAuth2 Credentials in Multi-Tenant Environments

SAP disclosed a critical CVSS 10.0 vulnerability (CVE-2026-89111) in its Cloud SDK for Python that allows attackers to steal OAuth2 client credentials from multi-tenant applications on SAP Business Technology Platform. The flaw enables attackers who control tenant subdomains to redirect authentication requests to malicious servers, capturing sensitive client IDs and secrets. While initially patched in version 0.45.2 released August 21, 2026, subsequent versions 0.53.0 through 0.55.0 reintroduced the vulnerability in certain modules before being definitively fixed in version 0.55.1. This incident highlights the growing sophistication of supply chain attacks targeting cloud SDKs and authentication mechanisms. As organizations increasingly adopt multi-tenant cloud architectures and rely on third-party development tools, vulnerabilities in widely-used SDKs pose systemic risks across entire ecosystems of applications and services.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains
Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains
Computer Software/Engineering3 weeks ago

Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains

Docker fixed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to push, pull, or delete container images as other users. The flaw, dubbed GhostPat, existed for over two years from August 2024 to September 2026 and stemmed from improper handling of personal access tokens (PATs) during account-to-organization conversions. Attackers could create a token, convert their account to an organization, and designate another user as owner, thereby gaining registry access under that user's identity. While Docker found no evidence of exploitation after reviewing 304,000 pushes, the vulnerability posed significant supply chain risks by enabling malicious image publication under legitimate names. This incident highlights the growing sophistication of supply chain attacks targeting container registries, coinciding with increased focus on software supply chain security following recent high-profile compromises and new regulatory requirements for software bill of materials tracking.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
Financial Services3 weeks ago

The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy

The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly ascended to become a top-five ransomware gang by Q1 2026 through their innovative EDR killer framework. The crew developed an industrialized approach to endpoint detection and response evasion, creating eight or more variants of their GentleKiller tool that targets over 400 security processes across 48 different security products. By offering affiliates a generous 90% revenue share compared to the industry standard of 80%, Gentlemen scaled their operation through volume rather than per-incident margins, transforming EDR evasion from a technical skill barrier into a commodity service available to low-skill threat actors. This incident represents the maturation of the bring-your-own-vulnerable-driver (BYOVD) attack technique from isolated tactics into a full-scale economy with pricing tiers, product roadmaps, and customer support models, fundamentally changing the threat landscape defenders face.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
Financial Services3 weeks ago

SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks

In October 2026, threat actors began actively exploiting CVE-2026-102255, a maximum-severity SSRF vulnerability in SonicWall SMA 1000 appliances. The flaw allows remote unauthenticated attackers to abuse the WorkPlace interface, directing appliances to issue internal requests and perform unauthorized operations. Cybersecurity firms Previdian and Defused detected exploitation attempts on their honeypot devices within days of SonicWall's advisory, despite the vendor initially reporting no evidence of active exploitation. This incident highlights the ongoing targeting of SSL-VPN and edge devices by cybercriminals, following previous zero-day attacks on SonicWall products by the Inc ransomware gang in July 2026. The vulnerability's trivial exploitation combined with SMA devices' position between public internet and corporate resources creates significant risk for organizations relying on legacy SSL-VPN solutions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports