Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 171 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2041–2052 / 3490 reports
Citrix NetScaler 2025 Memory Overread Vulnerability: Immediate Action Required
Financial Services7 months ago

Citrix NetScaler 2025 Memory Overread Vulnerability: Immediate Action Required

In June 2025, Citrix disclosed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and NetScaler Gateway, characterized by insufficient input validation leading to memory overread. This flaw allows unauthenticated attackers to remotely access sensitive memory contents, including session tokens and credentials, when the devices are configured as a Gateway or AAA virtual server. The vulnerability affects versions 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32. Citrix released patches on June 17, 2025, urging immediate updates to mitigate potential exploitation. ([support.citrix.com](https://support.citrix.com/external/article/CTX693420/netscaler-adc-and-netscaler-gateway-secu.html?utm_source=openai)) The urgency of addressing this vulnerability is underscored by its active exploitation in the wild, as reported by security agencies and researchers. Organizations are advised to apply the provided patches promptly to prevent unauthorized access and potential data breaches. ([techradar.com](https://www.techradar.com/pro/security/cisa-warns-hackers-are-actively-exploiting-critical-citrixbleed-2?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Iran-Linked Hackers Breach FBI Director's Email and Stryker Systems in 2026
Government Administration7 months ago

Iran-Linked Hackers Breach FBI Director's Email and Stryker Systems in 2026

In March 2026, the pro-Iranian hacktivist group Handala Hack Team executed two significant cyberattacks. First, they breached the personal Gmail account of FBI Director Kash Patel, leaking personal photos and documents online. The FBI confirmed the authenticity of the materials but emphasized that no government-related information was compromised. Shortly thereafter, Handala targeted Stryker Corporation, a leading medical technology company, deploying wiper malware that disrupted global operations by wiping over 200,000 systems and exfiltrating 50 terabytes of data. This attack forced Stryker to halt manufacturing and order processing, impacting healthcare supply chains worldwide. ([apnews.com](https://apnews.com/article/9237ca30d1c85f237d7d83e6798d97f0?utm_source=openai)) These incidents underscore the escalating cyber threats posed by state-linked actors targeting both government officials and critical infrastructure. The attacks highlight the vulnerabilities in personal email security and the potential for significant operational disruptions in the healthcare sector due to cyberattacks. Organizations must enhance their cybersecurity measures to protect sensitive information and ensure business continuity in the face of such threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
F5 BIG-IP 2025 Remote Code Execution Vulnerability
Government Administration7 months ago

F5 BIG-IP 2025 Remote Code Execution Vulnerability

In October 2025, a critical vulnerability identified as CVE-2025-53521 was discovered in F5 Networks' BIG-IP Access Policy Manager (APM). This flaw allows specific, undisclosed traffic to cause the Traffic Management Microkernel (TMM) to terminate unexpectedly, leading to a denial-of-service (DoS) condition. The vulnerability affects multiple versions of BIG-IP, including 17.5.0, 17.1.0, 16.1.0, and 15.1.0, and has been assigned a CVSS v3.1 score of 7.5, indicating high severity. ([wiz.io](https://www.wiz.io/vulnerability-database/cve/cve-2025-53521?utm_source=openai)) The exploitation of this vulnerability can disrupt critical services relying on BIG-IP systems, posing significant risks to organizations. Given the widespread deployment of BIG-IP devices in enterprise environments, timely remediation is essential to prevent potential service outages and maintain operational continuity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Understanding the 2026 TeamPCP Supply Chain Attack
Computer Software/Engineering7 months ago

Understanding the 2026 TeamPCP Supply Chain Attack

In March 2026, the cybercriminal group TeamPCP executed a sophisticated supply chain attack targeting multiple software packages and cloud services. The campaign began on March 19, 2026, with successive compromises of tools like Trivy, CanisterWorm, Checkmarx, LiteLLM, and Telnyx, occurring every 1-3 days. These attacks involved injecting malicious code into widely used software packages, enabling unauthorized access and data exfiltration from numerous downstream users. The rapid succession of these breaches highlighted the group's aggressive operational tempo and their focus on exploiting trusted software supply chains. As of March 28, 2026, a notable shift in TeamPCP's strategy was observed, with no new compromises reported in the preceding 48 hours. This pause suggests a transition from expanding their foothold to monetizing the vast trove of stolen credentials and data. The group's explicit intent to maintain a prolonged presence indicates that future supply chain attacks remain a significant threat. Organizations are advised to remain vigilant, conduct thorough security assessments, and implement robust monitoring to detect and mitigate potential breaches stemming from this campaign.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Handala Hackers Breach FBI Director Kash Patel's Personal Email in 2026
Government Administration7 months ago

Handala Hackers Breach FBI Director Kash Patel's Personal Email in 2026

In March 2026, the Iranian-linked hacking group Handala claimed responsibility for breaching the personal email account of FBI Director Kash Patel. The group released personal photographs and documents, some dating back over a decade, allegedly obtained from Patel's personal Gmail account. The FBI confirmed awareness of the targeting, emphasizing that the compromised information was historical and did not involve government data. This incident underscores the persistent cyber threats posed by state-sponsored actors targeting high-profile individuals. The breach highlights the importance of securing personal communication channels, especially for individuals in sensitive positions, as adversaries continue to exploit such vulnerabilities for intelligence gathering and propaganda purposes.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
AI-Enhanced Cyber Threats Surge in 2026
Financial Services7 months ago

AI-Enhanced Cyber Threats Surge in 2026

In 2026, the cybersecurity landscape witnessed a significant surge in AI-enhanced cyber threats. Malicious actors leveraged artificial intelligence to automate and accelerate attacks, leading to a 72% increase in AI-powered cyber incidents compared to the previous year. These sophisticated attacks utilized generative AI tools to craft convincing phishing emails, deepfakes, and automated exploit development, drastically reducing the time required to breach systems and exfiltrate data. Organizations across various sectors faced unprecedented challenges in defending against these rapidly evolving threats. This escalation underscores the urgent need for organizations to adopt AI-driven defense mechanisms. Traditional security measures are increasingly inadequate against AI-powered attacks, necessitating the integration of advanced AI-based threat detection and response systems to effectively mitigate these emerging risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Security Vulnerabilities in LangChain and LangGraph: Immediate Action Required
Computer Software/Engineering7 months ago

Critical Security Vulnerabilities in LangChain and LangGraph: Immediate Action Required

In early 2026, multiple security vulnerabilities were identified in LangChain and LangGraph, two widely used open-source frameworks for building applications powered by Large Language Models (LLMs). These vulnerabilities include Server-Side Request Forgery (SSRF) in LangChain versions prior to 1.2.11, Regular Expression Denial-of-Service (ReDoS) in versions up to 0.3.1, and a critical Remote Code Execution (RCE) flaw in LangGraph's caching layer before version 4.0.0. Exploitation of these vulnerabilities could lead to unauthorized access to sensitive data, execution of arbitrary code, and potential system compromise. ([stack.watch](https://stack.watch/product/langchain-ai/langchain/?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of rigorous security practices in the development and maintenance of AI frameworks. As LLM-powered applications become increasingly prevalent, ensuring the security of underlying frameworks is crucial to prevent potential exploitation by malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Open VSX Registry's 2026 GlassWorm Supply Chain Attack: A Wake-Up Call for Extension Security
Computer Software/Engineering7 months ago

Open VSX Registry's 2026 GlassWorm Supply Chain Attack: A Wake-Up Call for Extension Security

In January 2026, the Open VSX Registry, a vendor-neutral extension marketplace for Visual Studio Code, experienced a significant supply chain attack. Threat actors compromised a legitimate publisher's account to distribute malicious updates to four popular extensions, collectively downloaded over 22,000 times. These updates deployed the GlassWorm malware, specifically targeting macOS users by exfiltrating sensitive data such as browser cookies, cryptocurrency wallets, and developer credentials. The malware utilized sophisticated evasion techniques, including locale checks and blockchain-based command-and-control mechanisms, to avoid detection and dynamically manage its infrastructure. ([securityweek.com](https://www.securityweek.com/open-vsx-publisher-account-hijacked-in-fresh-glassworm-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the critical need for robust security measures in extension marketplaces. In response, the Eclipse Foundation, which maintains the Open VSX Registry, has announced plans to implement pre-publication security checks to proactively identify and mitigate malicious extensions before they reach users. ([thehackernews.com](https://thehackernews.com/2026/02/eclipse-foundation-mandates-pre-publish.html?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple Issues Urgent Update for 'DarkSword' Exploit in 2026
Health Care / Life Sciences7 months ago

Apple Issues Urgent Update for 'DarkSword' Exploit in 2026

In March 2026, Apple issued urgent lock screen notifications to users of older iPhone and iPad models, warning them of active web-based exploits targeting outdated iOS versions. The 'DarkSword' exploit, which had been used by surveillance groups, became widely accessible after its code was leaked online, enabling attackers to exfiltrate sensitive data from devices running iOS versions 18.4 to 18.7. Apple responded by releasing security updates for iOS versions 15 through 26 and advised users on older systems to upgrade immediately to mitigate the risk. ([tomsguide.com](https://www.tomsguide.com/phones/iphones/darksword-exploit-just-went-global-millions-of-iphones-now-wide-open-to-hackers?utm_source=openai)) This incident underscores the critical importance of keeping devices updated to the latest software versions. The public availability of the 'DarkSword' exploit highlights the rapid dissemination of vulnerabilities and the necessity for users to remain vigilant against emerging threats. ([techradar.com](https://www.techradar.com/phones/update-your-iphone-now-apple-issues-a-rare-warning-to-ios-users-as-a-new-hacker-threat-is-discovered?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
TeamPCP's Malicious 'telnyx' PyPI Attack Exposes Supply Chain Vulnerabilities
Computer Software/Engineering7 months ago

TeamPCP's Malicious 'telnyx' PyPI Attack Exposes Supply Chain Vulnerabilities

In March 2026, the threat actor group TeamPCP executed a supply chain attack by uploading two malicious versions (4.87.1 and 4.87.2) of the 'telnyx' Python package to the Python Package Index (PyPI). These versions concealed credential-stealing malware within .WAV files, enabling the exfiltration of sensitive data from compromised systems. The attack underscores the vulnerability of open-source repositories to sophisticated supply chain compromises. This incident highlights the escalating trend of attackers targeting widely used open-source packages to distribute malware, emphasizing the need for enhanced vigilance and security measures in software supply chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Coruna Exploit Kit: A Case Study in the Commercialization of Nation-State Cyber Tools
Financial Services7 months ago

Coruna Exploit Kit: A Case Study in the Commercialization of Nation-State Cyber Tools

In February 2025, Google's Threat Intelligence Group (GTIG) identified 'Coruna,' a sophisticated iOS exploit kit comprising 23 vulnerabilities across five exploit chains, targeting devices running iOS 13 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian state actors in espionage campaigns against Ukrainian users. By December 2025, the exploit kit had proliferated to financially motivated Chinese cybercriminals, who employed it to steal cryptocurrency from over 42,000 iOS devices via malicious websites. This rapid transition from state-sponsored espionage to widespread financial crime underscores the growing commercialization and accessibility of nation-state-level cyber tools. The Coruna incident highlights the urgent need for organizations to stay vigilant against advanced threats, as sophisticated exploit kits once exclusive to government entities are increasingly available to cybercriminals, posing significant risks to both individuals and enterprises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
International Operation Dismantles LeakBase Cybercrime Forum in 2026
Financial Services7 months ago

International Operation Dismantles LeakBase Cybercrime Forum in 2026

In early March 2026, an international law enforcement operation led by the FBI and Europol dismantled LeakBase, one of the world's largest cybercrime forums. Established in 2021, LeakBase had over 142,000 members and facilitated the trade of stolen data, including account credentials and financial information. The coordinated effort spanned 14 countries, resulting in the seizure of the forum's domains and databases, as well as multiple arrests and searches targeting the platform's most active users. This operation underscores the growing global collaboration in combating cybercrime and highlights the increasing focus on dismantling platforms that facilitate the sale of stolen data. The takedown of LeakBase serves as a significant deterrent to cybercriminals and emphasizes the importance of international cooperation in addressing the evolving cyber threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports