Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Spark RAT Exploits Vulnerable OPSWAT Driver in Sophisticated Cambodia Campaign
Between June and August 2026, threat actors conducted a sophisticated campaign targeting individuals and organizations in Cambodia using Spark RAT, an open-source remote access trojan. The multi-stage attack leveraged phishing emails with localized lures including government notices and health materials to distribute Inno Setup executables. The campaign employed advanced techniques including DLL sideloading, bring-your-own-vulnerable-driver (BYOVD) tactics using OPSWAT's ardrv.sys driver, and multi-layered persistence mechanisms to disable security software and maintain access to compromised systems. This incident highlights the growing sophistication of nation-state and advanced persistent threat actors who are increasingly leveraging legitimate-but-vulnerable drivers to bypass modern endpoint security solutions, representing a critical evolution in attack methodologies that organizations must address immediately.
3 weeks ago
Kill Chain
How TeamPCP's Supply Chain Attack Compromised 1,000+ Organizations Through Trusted Security Tools
In March 2026, the TeamPCP cybercrime syndicate executed a sophisticated supply chain attack that compromised multiple open-source security tools including Trivy scanner, Checkmarx KICS, and LiteLLM AI gateway. The attackers stole publishing credentials from trusted projects and pushed poisoned versions through legitimate release channels across GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX ecosystems. This credential-chaining technique allowed them to compromise over 1,000 organizations globally, steal more than 500,000 credentials, and exfiltrate at least 300GB of sensitive data including CI/CD pipeline secrets and cloud access tokens. This incident highlights the growing sophistication of supply chain attacks targeting the software development lifecycle, particularly as organizations increasingly rely on open-source components and automated CI/CD pipelines without proper security controls and credential management practices.
3 weeks ago
Kill Chain
CISA Expands KEV Catalog: Six Critical Vulnerabilities Under Active Exploitation
On August 26, 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, spanning from 2015 to 2026. The vulnerabilities affect critical infrastructure components including Red Hat Libuser, Microsoft SQL Server, Linux Kernel, Ajax.NET Professional, and Citrix NetScaler ADC/Gateway systems. These CVEs enable race condition exploits, privilege escalation, remote code execution, deserialization attacks, memory corruption, and buffer overflow exploits that grant attackers total system control. This advisory reinforces the urgency of risk-based vulnerability management as federal agencies face increased scrutiny under BOD 26-04, which mandates rapid remediation of KEV-listed vulnerabilities on publicly exposed assets while establishing breach assessment requirements for delayed patching.
3 weeks ago
Kill Chain
Amazon Kiro IDE Vulnerability Exposes Critical AI Security Gaps
In August 2026, cybersecurity researchers disclosed a critical vulnerability in Amazon Kiro IDE that enables data exfiltration through prompt injection attacks. The flaw allows attacker-controlled repository content to influence Kiro's AI agent, causing sensitive local information to be transmitted to external endpoints without explicit user consent. Exploitation requires minimal user interaction - simply opening a malicious workspace file and sending any message to the agent triggers the vulnerable flow. Amazon addressed the issue in version 0.8.140 following responsible disclosure. This incident highlights the emerging threat landscape surrounding AI-powered development tools, where prompt injection attacks are becoming increasingly sophisticated. As organizations rapidly adopt AI coding assistants and autonomous development environments, these tools present new attack vectors that blur traditional security boundaries between trusted and untrusted content.
3 weeks ago
Kill Chain
AI Infrastructure Under Attack: Critical Vulnerabilities in LiteLLM, RAGFlow, and Kestra
Between 2026 and early 2027, Microsoft observed coordinated attacks targeting AI infrastructure components including LiteLLM gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration environments. Attackers exploited vulnerabilities including CVE-2026-42271, CVE-2026-48710, and CVE-2026-49869 to gain initial access, then systematically harvested model provider API keys, database credentials, and container secrets. The campaigns resulted in credential theft, cryptocurrency mining operations, persistent backdoor access, and potential unauthorized use of AI services. The attacks demonstrate how AI infrastructure has become a high-value target due to its concentration of credentials, data access privileges, and compute resources in centralized control points. These incidents highlight the emerging threat landscape where AI infrastructure components are increasingly targeted as control planes for broader enterprise compromise. As organizations rapidly deploy AI systems without adequate security controls, attackers are adapting their techniques to exploit the unique trust relationships and credential concentration inherent in AI gateways and orchestration platforms.
3 weeks ago
Kill Chain
Ubiquiti UniFi Hit by 22 Vulnerabilities Including Three Perfect 10.0 CVSS Flaws
In December 2024, Ubiquiti disclosed 22 security vulnerabilities across its UniFi product line, including three critical flaws rated 10.0 on the CVSS scale (CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554). These maximum-severity vulnerabilities enable attackers to exploit improper access control mechanisms, potentially gaining elevated privileges on affected devices. The flaws primarily affect network infrastructure equipment used by enterprises and service providers worldwide, with seven of the 22 vulnerabilities involving improper access control issues that could allow authentication bypass or arbitrary command execution. This disclosure highlights the escalating threat landscape targeting network infrastructure devices, which have become prime targets for nation-state actors and cybercriminals seeking persistent access to enterprise networks and critical infrastructure systems.
3 weeks ago
Kill Chain
The Snowflake Breach: Why Service Account Security Can't Wait Until October
In 2024, threat actor Connor Moucka and accomplices exploited valid but compromised Snowflake customer credentials to breach over 165 organizations, stealing billions of records including AT&T's wireless customer data. The attackers used years-old, unrotated passwords without multi-factor authentication to access Snowflake environments. Moucka pleaded guilty in August 2024 to computer fraud, wire fraud, and conspiracy charges. In response, Snowflake implemented a phased authentication rollout through 2026, culminating in the complete deprecation of password-based service accounts by October 2026. This incident highlights the growing threat landscape around identity-based attacks and the critical need for robust non-human identity management as organizations increasingly deploy AI agents and automated systems that require programmatic access to cloud platforms.
3 weeks ago
Kill Chain
Critical SharePoint RCE Chain: How CVE-2026-55040 and CVE-2026-63520 Enable Remote Code Execution
In August 2026, threat actors began actively exploiting a chained vulnerability in Microsoft SharePoint servers, combining CVE-2026-55040 (JWT authentication bypass) and CVE-2026-63520 (Business Connectivity Services RCE) to achieve remote code execution on unpatched systems. The attack chain allows unauthenticated attackers to first bypass authentication through JWT token validation flaws, then escalate to full code execution via SharePoint's Business Connectivity Services. With over 8,700 SharePoint servers exposed online and proof-of-concept exploits publicly available, CISA ordered federal agencies to immediately patch their systems as exploitation was detected in honeypots within days of PoC release. This incident represents a critical escalation in SharePoint targeting, with CISA having flagged 15 actively exploited SharePoint vulnerabilities since 2021, eight of which were used by ransomware groups. The rapid weaponization timeline demonstrates how quickly adversaries adapt public exploits for mass scanning and targeted attacks against enterprise collaboration platforms.
3 weeks ago
Kill Chain
Boston Scientific Cyberattack Disrupts Global Medical Device Operations
On August 25, 2026, Boston Scientific, a major medical device manufacturer with $20 billion in annual revenue, suffered a cyberattack that disrupted IT systems and caused global operational outages. The incident impacted critical business applications and halted the company's ability to process and ship customer orders across its 127-country presence. While the attack vector and threat actor remain undisclosed, the company activated incident response procedures and engaged external cybersecurity experts for containment and investigation efforts. The attack highlights the increasing threat to critical healthcare infrastructure and medical device supply chains. Healthcare organizations face heightened risks as ransomware groups target high-value entities with essential services, potentially affecting patient care and medical device availability worldwide.
3 weeks ago
Kill Chain
The Q2 2026 Vulnerability Crisis: When AI Acceleration Meets Exploit-First Disclosure
Q2 2026 witnessed an unprecedented surge in registered CVEs driven by widespread AI adoption in vulnerability research and application development. The period saw the emergence of the Dirty Frag family of Linux kernel vulnerabilities, including CVE-2026-43284 and CVE-2026-43500, which enable local privilege escalation through exploitation of the networking subsystem and page cache mechanisms. Simultaneously, security researcher Nightmare Eclipse published multiple Windows vulnerabilities including BlueHammer, RedSun, and YellowKey with functional exploits before CVE assignment or patches became available, establishing a dangerous precedent of exploit-first disclosure. The quarter also revealed significant security gaps in AI tools and LLM platforms, with injection vulnerabilities and improper access controls becoming increasingly prevalent as organizations rapidly integrate AI technologies without adequate security considerations.
3 weeks ago
Kill Chain
How FBI Takedown of Chinese QTFY Network Exposes Critical Zero Trust Gaps
In August 2026, the FBI disrupted a sophisticated Chinese state-sponsored cyber espionage operation conducted by the QTFY threat group, operated by Nanjing Xinjiuwei Network Technology Company. The group utilized QScan and QTRouter platforms to create an obfuscation network of compromised IoT devices and commercial proxies, enabling attacks against critical U.S. infrastructure including NASA, the Federal Reserve, Department of Energy, and the U.S. Senate. The operation leveraged zero-day vulnerabilities in Ivanti CSA appliances and numerous N-day exploits to establish persistent access while using the botnet to mask attack origins. This incident demonstrates the evolving sophistication of state-sponsored threat actors who are increasingly adopting industrialized, multi-tenant infrastructure models for large-scale espionage campaigns. The use of legitimate commercial proxy services mixed with compromised devices represents a significant challenge to traditional IP-based blocking and geographic filtering defenses.
3 weeks ago
Kill Chain
North Korean APT Group Exploits AI Development Supply Chain in Sophisticated Campaign
In July 2026, Amazon's threat intelligence team identified a North Korean state-sponsored hacker group behind multiple open-source supply chain attacks targeting NPM packages including axios, debug, chalk, and typo-crypto. The DPRK-linked threat actor demonstrated evolved tradecraft leveraging generative AI to enhance their attack methodologies. Simultaneously, AWS published 21 security bulletins addressing critical vulnerabilities across open-source SDKs, MCP servers, and developer tools, with key themes including credential disclosure, SSRF attacks, command injection, and insufficient input validation in AI-integrated workflows. This incident highlights the growing sophistication of nation-state actors exploiting the software supply chain, particularly as organizations rapidly adopt AI-powered development tools and agent-based workflows that expand the attack surface through LLM integrations.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports