Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
CISA Flags New High-Risk Vulnerabilities in 2025 KEV Catalog
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities—CVE-2025-6218 (RARLAB WinRAR Path Traversal) and CVE-2025-62221 (Microsoft Windows Use After Free)—to its Known Exploited Vulnerabilities (KEV) Catalog. These critical flaws are utilized by cyber attackers to gain unauthorized access, facilitate lateral movement, and potentially execute arbitrary code within federal and enterprise environments. CISA’s directive mandates that all Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified dates to mitigate significant risk, reinforcing the growing threat from rapid exploitation of newly discovered CVEs. This incident illustrates the ongoing challenges faced by organizations, as adversaries increasingly exploit widely used software at scale. The timely identification and remediation of KEV Catalog vulnerabilities are vital for maintaining strong security postures amid an uptick in exploitation and regulatory pressure to close known gaps.
8 months ago
Kill Chain
US Treasury Highlights $4.5B in Ransomware Payments: 2024 Threat Landscape
In February 2024, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) reported that ransomware attacks have resulted in over $4.5 billion in ransom payments since 2013, underscoring a dramatic surge in both scale and sophistication. Attackers typically infiltrated organizations through phishing campaigns, exploitation of unpatched vulnerabilities, and compromised remote desktop protocols, deploying ransomware variants to encrypt data and demand payment. These incidents disrupted critical business operations across sectors, forced enterprises to halt services, and left many struggling with reputational and financial damage. This report is especially relevant as ransomware strains evolve, facilitating large-scale attacks on enterprises, healthcare, and infrastructure. Heightened regulatory scrutiny, such as OFAC and FinCEN advisories, means organizations face intensified pressure to monitor, report, and prevent ransomware-related activities.
8 months ago
Kill Chain
React2Shell: Exploitation Surge Hits Businesses in 2025
In June 2025, attackers began widespread exploitation of CVE-2025-55182, a critical vulnerability known as React2Shell, shortly after it was publicly disclosed. Threat actors rapidly leveraged the unauthenticated remote code execution flaw to gain access to vulnerable web servers running the React2Shell component, allowing lateral movement, data exfiltration, and in some cases, ransomware deployment. The initial wave targeted a range of businesses, exploiting the window between disclosure and patch adoption, thus exposing organizations to operational disruption and compliance risks. The surge in React2Shell exploitation underscores an ongoing trend: cybercriminals are taking advantage of zero-day and recently publicized vulnerabilities with renewed speed and sophistication. Security teams must deal with shrinking patch windows, automated exploit tools, and increasing pressure from regulators to secure internet-facing applications.
8 months ago
Kill Chain
Apache Tika’s Critical Patch Flaw: 2024 Supply-Chain Wake-Up Call
In June 2024, The Apache Software Foundation disclosed that its initial patch for a critical vulnerability (CVE-2024-29945) in Apache Tika was incomplete, leaving systems exposed to remote code execution risks. Tika, widely used for content detection and extraction, is embedded in many enterprise and cloud-native applications, amplifying the scale of exposure through the software supply chain. Attackers who exploit this flaw can execute arbitrary code on affected servers, potentially enabling data breaches or lateral movement across environments. The revised advisory and updated CVE has prompted urgent action to remediate the unresolved security gap. This incident highlights persistent challenges around open-source supply chain risks, insufficient patch validation, and the rapid exploitation of incomplete fixes. Organizations must evaluate their dependency chains, continuously monitor vendor advisories, and implement layered security controls as supply-chain vulnerabilities become increasingly frequent and business-critical.
8 months ago
Kill Chain
Gemini Enterprise No-Click Vulnerability: A Wake-Up Call for AI/ML Security
In early 2024, Google addressed a severe vulnerability in its Gemini Enterprise AI platform that allowed attackers to craft common business documents containing malicious prompt injections. These attacks did not require any user interaction; simply opening or syncing affected documents enabled adversaries to exfiltrate sensitive organizational data, bypassing usual security controls. The flaw exploited Gemini’s integration with widely used Google Workspace applications. Attackers leveraged this vulnerability to gain unintended access to confidential files, customer data, and internal communications, posing material risks to business operations and reputation. This vulnerability exemplifies emerging no-click threats in AI-integrated enterprise ecosystems, where conventional perimeter defenses and user-awareness controls are ineffective. The incident underscores the urgency for organizations to review AI/ML security posture as attackers rapidly adapt to take advantage of new AI-powered workflows.
8 months ago
Kill Chain
UK Cyber Agency Issues Stark Warning: Prompt Injection in LLMs is Here to Stay
In June 2024, the UK’s National Cyber Security Centre (NCSC) publicly warned that large language models (LLMs), including popular AI tools such as ChatGPT and Claude, possess a fundamental and persistent vulnerability known as prompt injection. This flaw arises because LLMs are architecturally incapable of reliably distinguishing between trusted and untrusted input within prompts. Despite repeated industry efforts to implement guardrails, researchers routinely bypass these safeguards, allowing malicious actors to manipulate LLM behavior, potentially leading to harmful outputs or the execution of unauthorized actions in real-world applications that integrate LLMs. This alert is especially significant as LLM-driven automations are rapidly proliferating in software development, browser agents, and enterprise workflows. The NCSC’s assessment signals an urgent need for organizations to shift their risk models, as AI prompt injection represents a persistent, unfixable attack vector with serious implications for data security, business integrity, and regulatory compliance.
8 months ago
Kill Chain
Ransomware: FinCEN Reports Over $2.1B Paid to Gangs (2022–2024)
Between 2022 and early 2024, ransomware gangs operating globally extorted over $2.1 billion from victims, according to an official report by the Financial Crimes Enforcement Network (FinCEN). Activity surged markedly in 2023, driven by large-scale campaigns from prolific threat groups such as ALPHV/BlackCat and LockBit. Attackers commonly gained initial access through phishing, vulnerable VPNs, or exposed remote services, rapidly leveraging lateral movement and data exfiltration before deploying file-encrypting malware to maximize leverage. As a result, numerous organizations across multiple sectors experienced severe operational disruption, financial losses, reputational damage, and in some cases, regulatory scrutiny. This incident underscores the growing reach and impact of organized ransomware, even as some law enforcement takedowns in late 2023 and 2024 caused temporary disruption to top gangs. The pattern highlights evolving attacker strategies, heightened regulatory attention, and the need for proactive cyber defense and comprehensive incident response preparedness.
8 months ago
Kill Chain
JS#SMUGGLER Campaign: How Compromised Websites Delivered NetSupport RAT in 2025
In December 2025, cybersecurity researchers discovered a widespread campaign called JS#SMUGGLER leveraging compromised websites to deliver NetSupport RAT, a versatile remote access trojan. The attack chain involved injecting obfuscated JavaScript loaders onto legitimate sites, which delivered device-aware, multi-stage payloads via hidden iframes, HTML application (HTA) loaders, and encrypted PowerShell scripts. This sophisticated approach enabled attackers to remotely control infected hosts, exfiltrate sensitive data, and evade detection through in-memory and fileless techniques. The campaign targeted enterprise users indiscriminately and was attributed to yet-uncategorized threat actors, though infrastructure overlap with SmartApeSG was noted. The incident is a timely reminder of advancing web-based malware deployment tactics, blending script obfuscation, evasive loaders, and context-aware delivery. As enterprises increasingly rely on web interfaces and remote access, defenders face mounting pressure to detect, segment, and monitor east-west and egress network activity in real time to thwart lateral movement and data theft.
8 months ago
Kill Chain
Active Exploitation of React2Shell: How Chinese APTs Breached the Supply Chain in 2025
In December 2025, security researchers identified a critical vulnerability, CVE-2025-55182 (React2Shell), actively exploited in the wild by suspected Chinese threat actors Earth Lamia and Jackpot Panda. The flaw impacts React Server Components in several Meta-maintained packages (versions 19.0 to 19.2.0), allowing attackers to execute arbitrary code on backend servers via unsafe deserialization at API endpoints. First reported by AWS Threat Intelligence on December 4, evidence ties multiple untracked clusters and IP addresses to coordinated supply-chain attacks targeting organizations operating modern web stacks. In successful compromises, attackers gained full backend access, posing serious risks to enterprise data and operations. This incident underscores the rapid weaponization of supply-chain vulnerabilities and the growing sophistication of state-aligned APTs exploiting core software dependencies. React2Shell highlights the urgent need for rigorous patch management, attack surface monitoring, and proactive defense as critical technologies become frequent entry points for advanced adversaries.
8 months ago
Kill Chain
CISA Flags Active D-Link & Array Networks Vulnerabilities in 2025 KEV Catalog
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog to include two actively exploited vulnerabilities: CVE-2022-37055, a buffer overflow in D-Link routers, and CVE-2025-66644, an OS command injection flaw impacting Array Networks ArrayOS AG. These vulnerabilities provide attack vectors for cybercriminals to gain unauthorized access, conduct lateral movement, or exfiltrate sensitive data within federal and private sector networks. The directive mandates that all Federal Civilian Executive Branch (FCEB) agencies address these threats promptly to reduce risk exposure and protect operational integrity. This update underscores the persistent threat posed by unpatched network infrastructure vulnerabilities, which remain prime targets for attackers. Timely remediation of KEV-listed vulnerabilities is increasingly critical for all organizations amid a rising trend of targeted attacks against widely deployed network devices.
8 months ago
Kill Chain
React2Shell Vulnerability Triggers Mass Breach Across 30+ Organizations in 2025
In early 2025, researchers discovered that over 77,000 internet-exposed IP addresses are vulnerable to a critical Remote Code Execution (RCE) flaw in the React2Shell framework (CVE-2025-55182). Threat actors rapidly exploited this vulnerability to breach at least 30 organizations across sectors such as finance, healthcare, and technology. Attackers leveraged the exploit to gain remote control, exfiltrate data, and potentially deploy malware across impacted systems, highlighting significant risks to operational resilience and data privacy. The compromised firms are now racing to contain lateral movement and mitigate exposure amid ongoing incident response. This incident illustrates a growing trend of attackers rapidly weaponizing newly disclosed vulnerabilities in popular frameworks for mass exploitation. It underscores the urgent need for timely patch management, robust segmentation, and comprehensive monitoring to counter the escalating threat from opportunistic RCE attacks targeting exposed internet-facing assets.
8 months ago
Kill Chain
Escalating Credential Attacks on Palo Alto GlobalProtect VPNs: 2024 Threat Review
In early 2024, cybersecurity analysts observed a widespread campaign targeting Palo Alto Networks’ GlobalProtect VPN portals and SonicWall SonicOS API endpoints with aggressive login attempts and scanning activity. Threat actors used automated tools to conduct credential stuffing and exploit potential vulnerabilities in exposed VPN portals, aiming to gain unauthorized network access. While no specific breaches were confirmed, the campaign's scope affected numerous organizations globally relying on these remote access solutions, highlighting the heightened risk to large enterprises and managed service providers leveraging vulnerable or misconfigured VPN infrastructure. This incident illustrates the surge in identity-driven and credential-based attacks exploiting remote access technologies, especially as hybrid and remote workforces remain prevalent. The rapid evolution and broad targeting underscore the urgent need for continuous VPN hardening, robust access governance, and threat monitoring to preempt similar intrusion attempts impacting business continuity.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports