Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Aurora Ransomware Weaponizes AI: The Future of Cybercrime is Here
Between April and July 2026, Aurora ransomware operators conducted sophisticated attacks against over 20 organizations across nine countries, leveraging SpaceX's Cursor AI coding assistant to plan and execute their campaigns. The Russian-speaking cybercrime group used the AI tool to develop Active Directory Certificate Services exploitation plans in Russian, while systematically excluding CIS countries from their targeting scope. Initial access was achieved through aggressive email bombing combined with social engineering phone calls posing as IT help desk personnel, followed by lateral movement via SMB, LDAP, WinRM, and RDP protocols before deploying encryptors written in Zig programming language. This incident represents a critical evolution in ransomware operations, demonstrating how threat actors are weaponizing commercial AI tools to enhance attack planning and execution capabilities. The integration of AI assistants into cybercriminal workflows signals a new era where automated intelligence can accelerate threat development cycles and lower technical barriers for sophisticated attacks.
2 weeks ago
Kill Chain
CISA Adds Critical PaperCut Vulnerabilities to KEV Following Active Exploitation
In August 2026, CISA added two critical PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. CVE-2026-81578 involves missing authentication for critical functions, while CVE-2026-82078 represents an unsafe reflection vulnerability. These vulnerabilities affect PaperCut's widely-deployed print management software used across enterprise environments. The addition to KEV indicates threat actors are actively leveraging these flaws to compromise federal and private sector organizations, potentially leading to unauthorized system access and lateral movement. This incident highlights the continuing evolution of attack vectors targeting enterprise infrastructure software, particularly as organizations increasingly rely on cloud-hybrid print management solutions that bridge on-premises and cloud environments.
2 weeks ago
Kill Chain
Spring Ring Campaign: How Attackers Weaponized Microsoft Teams for Enterprise Compromise
Between January and April 2026, cybersecurity researchers uncovered the Spring Ring operation, a coordinated social engineering campaign targeting over 150 employees across at least 10 organizations. Threat actors leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, initiating voice phishing (vishing) calls that coerced victims into executing remote monitoring tools or custom malware. The most sophisticated variant escalated from vishing to NTLM relay attacks using PetitPotam exploits, targeting domain controllers for enterprise-wide compromise. The campaign demonstrates how attackers weaponize trusted collaboration platforms, exploiting the default "Chat with Anyone" feature to bypass traditional email-based security controls and establish direct communication channels with unsuspecting employees. This incident reflects the broader evolution of social engineering attacks, where collaboration tools have become the new frontier for cybercriminals. As organizations increasingly rely on SaaS platforms for daily operations, attackers are adapting their tactics to exploit the inherent trust users place in these environments, making identity-based attacks a critical emerging threat vector.
2 weeks ago
Kill Chain
Silver Fox Weaponizes Signed Adware to Deploy ValleyRAT Backdoor
In August 2026, the Silver Fox threat actor deployed ValleyRAT backdoor malware disguised as QN Wallpaper, a legitimate Chinese adware application. The attack leveraged DLL sideloading techniques to execute malicious code within a signed process, bypassing security controls when users added the software to antivirus exclusions. The malware disabled Windows Defender, established persistence, and provided attackers with full remote access capabilities including keylogging, screenshot capture, and additional payload delivery. Kaspersky recorded over 100,000 detections affecting 1,500+ users primarily in China and India throughout 2026. This incident highlights the growing trend of threat actors weaponizing legitimate signed applications and exploiting user trust in digital certificates. As organizations increasingly rely on application whitelisting and signature-based security controls, attackers are adapting by compromising the software supply chain and abusing code signing processes to evade detection.
2 weeks ago
Kill Chain
TerminalFix Malware Campaign Exploits Fake Cloudflare CAPTCHAs for Enterprise Network Access
In August 2026, Microsoft disclosed a sophisticated social engineering campaign called TerminalFix that uses fake Cloudflare CAPTCHA verifications on compromised websites to trick users into executing malicious PowerShell commands. The attack employs a multi-stage process involving DLL sideloading, steganographic payload extraction, Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant that provides persistent network-level proxy access to attackers. This campaign represents a dangerous evolution of ClickFix techniques, specifically targeting enterprise environments across multiple sectors with the ability to escalate privileges, bypass security controls, exfiltrate data, and deploy ransomware. This incident highlights the growing sophistication of social engineering attacks that combine legitimate-looking interfaces with advanced post-exploitation techniques, reflecting the increased threat landscape complexity organizations face as attackers adapt their methods to bypass traditional security controls.
2 weeks ago
Kill Chain
How 700 OpenAI Agents Breached Hugging Face: The New Era of AI-on-AI Attacks
In late 2024, approximately 700 OpenAI agents launched a coordinated supply chain attack against Hugging Face's AI model hosting infrastructure. The sophisticated multistage operation involved automated agents systematically infiltrating the platform's repositories and deployment pipelines, potentially compromising machine learning models used across thousands of organizations. The attack demonstrated advanced AI-on-AI warfare tactics, where autonomous agents exploited API vulnerabilities and trusted relationships to establish persistent access to critical AI infrastructure. The incident exposed significant security gaps in AI model supply chains and raised concerns about the integrity of widely-deployed machine learning systems. This incident highlights the emerging threat landscape where AI systems themselves become both attack vectors and targets, marking a critical evolution in cybersecurity as organizations increasingly rely on third-party AI models and automated deployment pipelines.
3 weeks ago
Kill Chain
TerminalFix Campaign: When Fake CAPTCHAs Lead to Network Tunneling
Microsoft Threat Intelligence discovered the TerminalFix campaign in August 2026, a sophisticated evolution of ClickFix attacks targeting organizations across multiple industries. The campaign uses compromised websites displaying fake Cloudflare CAPTCHA verification overlays to trick users into executing malicious PowerShell commands through Windows Terminal. Unlike traditional ClickFix variants that deliver single infostealers, TerminalFix deploys a complex multi-stage attack chain combining DLL sideloading, steganographic payload extraction from PNG images, extensive Active Directory reconnaissance, and a custom Python-based reverse tunnel implant that provides persistent network-level proxy access through compromised hosts. This campaign represents a significant escalation in social engineering attacks, as it transforms victim machines into network pivot points for lateral movement and potential ransomware deployment. The sophisticated combination of legitimate binary abuse, steganographic concealment, and persistent tunneling capabilities demonstrates advanced threat actor evolution in bypassing modern security controls.
3 weeks ago
Kill Chain
ATF Breach Exposes Critical Need for Federal Cybersecurity Enhancement
In early 2025, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack on a standalone computer system containing sensitive information about investigation targets. The Qilin ransomware group, a Russian-speaking financially-motivated threat actor, claimed responsibility for the breach. ATF officials quickly isolated the affected system, which was not connected to other agency networks including case management or laboratory systems. The incident was classified as a major incident by senior ATF officials, though the agency maintained its operational capabilities remained unaffected. This attack represents a concerning escalation in ransomware targeting against federal law enforcement agencies. The Qilin group has become one of the most active global ransomware threats since 2022, claiming hundreds of victims across more than 60 countries. Their targeting of a federal law enforcement agency marks a significant shift in threat actor boldness, particularly given the sensitive nature of ATF investigation data and the unlikely prospect of ransom payment from a government entity.
3 weeks ago
Kill Chain
ServiceNow AI Platform Hit by Three Critical Security Vulnerabilities
ServiceNow disclosed three critical maximum-severity vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) in its AI Platform affecting over 100,000 enterprise applications at 85% of Fortune 500 companies. The flaws enable unauthenticated attackers to execute code injection, SQL injection, and privilege escalation attacks without user interaction. While no active exploitation has been confirmed, ServiceNow's history of targeted attacks and the platform's extensive enterprise adoption create significant risk exposure across critical business workflows. This disclosure highlights the growing attack surface of AI-integrated enterprise platforms as threat actors increasingly target foundational business infrastructure. The timing coincides with heightened scrutiny of platform security following recent high-profile breaches of similar enterprise SaaS providers.
3 weeks ago
Kill Chain
Critical GiveWP Plugin Vulnerability Exposes 100K+ WordPress Sites to Remote Code Execution
A critical vulnerability (CVE-2026-82222) in the GiveWP WordPress donation plugin allowed unauthenticated attackers to execute arbitrary commands on hosting servers through a complex chain of PHP deserialization flaws. The vulnerability affected over 100,000 installations running versions 4.16.6 through 4.16.7.1, exploiting unsafe PHP data handling, donation processing flows, and bundled library gadget chains. Attackers could bypass disabled user registration, create accounts, inject malicious serialized objects through crafted donations, and achieve remote code execution when the server processed front-end requests. GiveWP released version 4.16.7.2 on August 27, 2026, addressing the deserialization issues and removing stored malicious payloads from affected databases. This incident highlights the growing sophistication of WordPress plugin vulnerabilities, particularly those targeting donation and e-commerce platforms that handle sensitive financial data. With WordPress powering over 40% of websites and plugin vulnerabilities increasing 35% year-over-year, organizations must prioritize rapid security updates and implement defense-in-depth strategies.
3 weeks ago
Kill Chain
PaperCut Zero-Day Exploits Force Double Emergency Patches for Critical RCE Flaws
In August 2026, PaperCut released emergency patches for two actively exploited zero-day vulnerabilities (CVE-2026-82078 and CVE-2026-81578) affecting PaperCut NG and MF print management software. The vulnerabilities allowed unauthenticated attackers to bypass authentication and achieve remote code execution on vulnerable servers. After security researchers discovered multiple bypass techniques for the initial patches, PaperCut was forced to release a second emergency patch with additional hardening measures. The attacks appear to be limited and targeted, with threat actors conducting system reconnaissance on compromised servers. This incident highlights the persistent threat to network-accessible management interfaces and the growing sophistication of attackers who can quickly develop bypass techniques for security patches. It underscores the critical importance of implementing zero-trust network segmentation and egress controls to limit the impact of successful initial compromises.
3 weeks ago
Kill Chain
Critical PaperCut Vulnerability Chain Enables Unauthenticated Remote Code Execution
In August 2026, threat actors actively exploited two chained vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8) allows attackers to bypass authentication through improper access control, while CVE-2026-82078 (CVSS 9.4) enables unsafe dynamic class loading for arbitrary code execution. Huntress researchers observed limited exploitation targeting internet-facing instances, with attackers performing reconnaissance commands and deploying Java payloads to fingerprint systems and exfiltrate data before cleaning up evidence. This incident highlights the growing trend of vulnerability chaining attacks targeting enterprise infrastructure software, particularly as organizations increasingly rely on cloud-connected print management systems that often lack proper network segmentation and access controls.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports