Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 178 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2125–2136 / 3490 reports
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Government Administration7 months ago

CISA Adds Two Known Exploited Vulnerabilities to Catalog

On March 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-3909, an out-of-bounds write vulnerability in Google Skia, and CVE-2026-3910, an unspecified vulnerability in Google Chromium's V8 engine. These vulnerabilities have been actively exploited, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 22-01 mandates Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by the specified due date to protect against active threats. Although BOD 22-01 applies specifically to FCEB agencies, CISA strongly urges all organizations to prioritize timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practices. The agency continues to add vulnerabilities to the catalog that meet specified criteria, emphasizing the importance of proactive cybersecurity measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SmartApeSG 2026: Unveiling the Remcos RAT Threat via ClickFix Fake CAPTCHA
Financial Services7 months ago

SmartApeSG 2026: Unveiling the Remcos RAT Threat via ClickFix Fake CAPTCHA

In March 2026, the SmartApeSG campaign employed a sophisticated social engineering tactic known as ClickFix, utilizing fake CAPTCHA pages to distribute the Remcos Remote Access Trojan (RAT). Victims were deceived into executing malicious commands via the Windows Run dialog, leading to the installation of Remcos RAT through DLL side-loading techniques. This method granted attackers unauthorized remote control over infected systems, enabling data exfiltration and further malicious activities. The campaign's reliance on compromised legitimate websites to host these fake CAPTCHA pages underscores the evolving nature of cyber threats and the importance of user vigilance. The SmartApeSG campaign highlights a significant shift in cybercriminal strategies, emphasizing the use of social engineering to bypass traditional security measures. The increasing prevalence of such tactics necessitates enhanced awareness and proactive security measures to mitigate the risks associated with these deceptive attack vectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Brutus Integrates Sticky Keys Backdoor Detection to Strengthen RDP Security
Financial Services7 months ago

Brutus Integrates Sticky Keys Backdoor Detection to Strengthen RDP Security

In February 2026, Praetorian released Brutus, an open-source credential testing tool designed to automate the detection of Sticky Keys backdoors in Remote Desktop Protocol (RDP) services. The Sticky Keys backdoor is a persistence mechanism where attackers replace accessibility executables like sethc.exe with cmd.exe, allowing unauthorized system-level access via the RDP login screen. Brutus enhances security assessments by integrating this detection capability, enabling organizations to identify and remediate such vulnerabilities efficiently. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/13/brutus-open-source-credential-testing-tool-offensive-security/?utm_source=openai)) The release of Brutus addresses the growing need for automated tools to detect and mitigate RDP-based backdoors, which have been exploited in various cyber attacks. By incorporating this functionality, Brutus aids security teams in proactively identifying and addressing potential entry points that could be leveraged by attackers to gain unauthorized access to systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Google Chrome Zero-Day Exploits Patched in March 2026
Financial Services8 months ago

Google Chrome Zero-Day Exploits Patched in March 2026

In March 2026, Google identified and patched two high-severity zero-day vulnerabilities in its Chrome browser, tracked as CVE-2026-3909 and CVE-2026-3910. CVE-2026-3909 involved an out-of-bounds write in Skia, a 2D graphics library, while CVE-2026-3910 was an inappropriate implementation issue in the V8 JavaScript engine. Both vulnerabilities were actively exploited in the wild, allowing attackers to execute arbitrary code or crash the browser. Google released emergency updates for Windows, macOS, and Linux to address these flaws. ([malwarebytes.com](https://www.malwarebytes.com/blog/news/2026/02/update-chrome-now-zero-day-bug-allows-code-execution-via-malicious-webpages?utm_source=openai)) This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. Organizations should prioritize patch management and implement robust security measures to mitigate risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-2561's Fake VPN Client Campaign: A Wake-Up Call for Enterprise Security
Financial Services8 months ago

Storm-2561's Fake VPN Client Campaign: A Wake-Up Call for Enterprise Security

In March 2026, the threat actor known as Storm-2561 launched a sophisticated campaign targeting enterprise users by distributing counterfeit VPN clients from reputable vendors such as Ivanti, Cisco, and Fortinet. Utilizing search engine optimization (SEO) poisoning, the attackers manipulated search results to direct users searching for VPN software to malicious websites that closely resembled legitimate vendor sites. Upon downloading and installing these fake VPN clients, users inadvertently installed malware designed to steal VPN credentials and configuration data, which were then exfiltrated to the attackers' infrastructure. This method allowed Storm-2561 to gain unauthorized access to corporate networks, posing significant security risks. This incident underscores a growing trend where cybercriminals exploit SEO techniques to distribute malware through seemingly legitimate channels. The use of fake enterprise applications as lures highlights the need for organizations to implement robust security measures, including user education on verifying software sources, enabling multi-factor authentication, and deploying advanced threat detection systems to mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities in Veeam Backup & Replication: Immediate Action Required
Financial Services8 months ago

Critical Vulnerabilities in Veeam Backup & Replication: Immediate Action Required

In January 2026, Veeam released security updates to address multiple critical vulnerabilities in its Backup & Replication software, notably CVE-2025-59470, which allows Backup or Tape Operators to perform remote code execution as the postgres user by sending malicious parameters. These flaws affect version 13.0.1.180 and earlier builds, potentially enabling unauthorized access and control over backup infrastructures. Organizations are strongly urged to apply the available patches promptly to prevent potential system compromise and data loss. ([thehackernews.com](https://thehackernews.com/2026/01/veeam-patches-critical-rce.html?utm_source=openai)) The urgency of this update is underscored by the increasing targeting of backup systems by threat actors, aiming to exploit such vulnerabilities for data exfiltration and ransomware attacks. Ensuring timely patching and adherence to security best practices is crucial to safeguard sensitive data and maintain operational integrity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention
Information Technology/IT8 months ago

CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention

In March 2026, cybersecurity researchers identified nine critical vulnerabilities, collectively named 'CrackArmor,' within the Linux kernel's AppArmor module. These flaws, present since 2017, allow unprivileged users to manipulate security profiles, bypass user-namespace restrictions, and execute arbitrary code within the kernel, leading to potential root privilege escalation and compromised container isolation. The vulnerabilities affect all Linux kernels since version 4.11 on distributions integrating AppArmor, including Ubuntu, Debian, and SUSE. Immediate kernel patching is strongly advised to mitigate these risks. The disclosure of CrackArmor underscores the persistent challenges in securing kernel-level modules and the importance of timely vulnerability management. Organizations relying on AppArmor for mandatory access control should prioritize updates and review their security configurations to prevent exploitation of these flaws.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs
Financial Services8 months ago

CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs

In January 2026, Microsoft Defender Experts identified a new evolution in the ongoing ClickFix campaign, dubbed 'CrashFix'. This variant begins with victims installing a malicious browser extension that impersonates legitimate ad blockers. Once installed, the extension deliberately crashes the browser and displays a fake security warning, instructing users to execute a command via the Windows Run dialog. This command abuses the legitimate Windows utility 'finger.exe' to download and execute a Python-based Remote Access Trojan (RAT), granting attackers persistent access to the compromised system. The RAT enables extensive reconnaissance, data exfiltration, and potential deployment of additional malware payloads. The 'CrashFix' variant represents a significant escalation in ClickFix tactics, combining user disruption with sophisticated social engineering to increase execution success while reducing reliance on traditional exploit techniques. This evolution underscores the growing trend of attackers leveraging trusted user actions and native OS utilities to bypass traditional defenses, highlighting the critical need for behavior-based detection and heightened user awareness.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-2561's 2026 SEO Poisoning Campaign: A Wake-Up Call for VPN Security
Computer/Network Security8 months ago

Storm-2561's 2026 SEO Poisoning Campaign: A Wake-Up Call for VPN Security

In January 2026, the threat actor known as Storm-2561 initiated a credential theft campaign by distributing trojanized VPN clients through search engine optimization (SEO) poisoning. Users searching for legitimate enterprise VPN software were redirected to attacker-controlled websites hosting malicious ZIP files. These files contained digitally signed trojans masquerading as trusted VPN clients, which, upon installation, harvested VPN credentials. The malware employed techniques such as DLL sideloading and displayed fake VPN sign-in dialogs to capture user credentials. Microsoft observed this activity and attributed it to Storm-2561, a group active since May 2025, known for propagating malware through SEO poisoning and impersonating popular software vendors. The campaign underscores the exploitation of trust in search engine rankings and software branding as social engineering tactics to steal data from users seeking enterprise VPN software. Additionally, the abuse of trusted platforms like GitHub to host malicious installer files highlights the evolving sophistication of such attacks. Organizations are advised to implement multi-factor authentication (MFA) on all accounts, exercise caution when downloading software, and ensure the authenticity of sources to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Google Chrome Zero-Day Vulnerabilities Patched in March 2026
Financial Services8 months ago

Google Chrome Zero-Day Vulnerabilities Patched in March 2026

In March 2026, Google identified and patched two high-severity zero-day vulnerabilities in its Chrome browser: CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910, an inappropriate implementation in the V8 JavaScript engine. Both flaws allowed remote attackers to execute arbitrary code via crafted HTML pages and were actively exploited in the wild. Google released updates to address these issues, urging users to update their browsers promptly. This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. The rapid identification and patching of these flaws highlight the need for continuous vigilance and proactive security measures in the face of evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Iran MOIS's 2026 Cyber Collaboration with Criminal Groups
Health Care / Life Sciences8 months ago

Iran MOIS's 2026 Cyber Collaboration with Criminal Groups

In March 2026, Iran's Ministry of Intelligence and Security (MOIS) intensified its cyber operations by collaborating with cybercriminal groups to enhance the scale and effectiveness of its attacks. This partnership led to a series of sophisticated cyberattacks targeting critical infrastructure and private sector entities in the United States and Europe. The MOIS leveraged the expertise and tools of cybercriminals to conduct operations that included data breaches, ransomware attacks, and disruptive activities against government and corporate networks. ([forbes.com](https://www.forbes.com/sites/steveweisman/2026/03/03/irans-cyberwarfare-attacks-will-be-targeting-critical-infrastructure/?utm_source=openai)) This incident underscores a concerning trend where state-sponsored actors are increasingly partnering with cybercriminal organizations to achieve geopolitical objectives. Such collaborations blur the lines between nation-state and criminal cyber activities, complicating attribution and response efforts. Organizations must remain vigilant and adapt their cybersecurity strategies to address this evolving threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sophisticated Phishing Campaign Leverages React and EmailJS for Credential Theft
Financial Services8 months ago

Sophisticated Phishing Campaign Leverages React and EmailJS for Credential Theft

In March 2026, a sophisticated phishing campaign was identified, utilizing a React-based web application to create a dynamic and convincing fake Dropbox Transfer page. The attackers distributed emails impersonating WeTransfer notifications, enticing recipients to click on a link leading to the fraudulent site. Upon attempting to download the purported files, users were prompted to enter their email credentials. These credentials were then exfiltrated using EmailJS, a legitimate email service, allowing the attackers to collect sensitive information without deploying their own infrastructure. This method not only enhanced the credibility of the phishing page but also helped evade traditional security measures. The use of React for dynamic content rendering and the exploitation of legitimate services like EmailJS signify an evolution in phishing tactics, making detection and prevention more challenging. Organizations must remain vigilant and educate users about such sophisticated social engineering techniques to mitigate the risk of credential theft.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports