✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
CVE-2026-28323: Critical SAML Bypass Exposes SolarWinds Help Desk Systems
CVE-2026-28323 is a critical SAML authentication bypass vulnerability in SolarWinds Web Help Desk versions 2026.1 and earlier, discovered in July 2026. Attackers can forge SAML responses and bypass login screens entirely without valid credentials, gaining administrative access to help desk systems. The vulnerability stems from conditional signature verification that only validates SAML responses when certificates are present, and accepts unsigned responses even when certificates are configured. With a CVSS score of 9.8, this flaw allows complete takeover of help desk systems containing sensitive corporate data and service tickets through a single HTTP request. This incident highlights the continued risks of legacy SAML implementations as organizations increasingly rely on federated identity for Zero Trust architectures, making proper SAML security validation more critical than ever.
1 day ago
Kill Chain
SonicWall SMA 1000 Zero-Days: How Edge Device Vulnerabilities Expose Enterprise Networks
SonicWall disclosed two actively exploited zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in SMA 1000 appliances in January 2025, with CISA adding them to its Known Exploited Vulnerabilities catalog. Rapid7 researchers confirmed the flaws can be chained together to achieve unauthenticated remote code execution, with the first being a maximum severity pre-authentication server-side request forgery vulnerability and the second a high-severity OS command injection flaw. The attacks represent the latest in a series of compromises targeting SonicWall customers, with ransomware groups including INC and Akira showing particular interest in exploiting these edge devices for initial access. This incident highlights the accelerating trend of threat actors targeting network appliances as primary attack vectors, particularly as organizations increase their reliance on edge security devices for zero trust architectures and hybrid cloud connectivity.
1 day ago
Kill Chain
When Employee Passwords Appear in Infostealer Logs: A Critical Security Response Framework
A growing cybersecurity challenge has emerged where employee corporate credentials are increasingly appearing in infostealer malware logs, with approximately 46% originating from unmanaged personal devices. These logs contain not just passwords but authenticated session cookies that can bypass multi-factor authentication, creating immediate access risks. Research indicates that exposure involving credentials for major SaaS and cloud services is growing 29% annually, with roughly 90% of logs now circulating through Telegram channels where they're accessible to initial access brokers and ransomware affiliates. This threat represents the convergence of several critical cybersecurity trends: the rise of hybrid work environments, increased reliance on SaaS applications, and the evolution of credential theft from simple password harvesting to comprehensive session hijacking. Organizations must now treat infostealer monitoring as an essential component of identity security programs.
1 day ago
Kill Chain
€500K GDPR Fine: How Weak Access Controls Led to France's Largest Healthcare Data Breach
In summer 2025, Hôpital privé de la Loire, a French hospital in Saint-Étienne, suffered a devastating data breach that exposed sensitive information of 727,000 individuals, including 524,867 patients and 202,246 trusted third parties. The attack, executed by a teenage hacker using the alias 'Marak,' began with compromising a single doctor's account and exploiting inadequate access controls to access the entire electronic patient record system. The attacker operated undetected for several days due to lack of real-time monitoring, extracting massive volumes of sensitive healthcare data. France's data protection authority CNIL subsequently fined the hospital €500,000 for multiple GDPR violations, including insufficient authentication controls and failure to properly notify all affected parties. This incident highlights the escalating threat to healthcare organizations as attackers increasingly target medical institutions for valuable patient data, with healthcare breaches reaching record levels in 2024-2025 and regulatory enforcement becoming more stringent across Europe.
1 day ago
Kill Chain
Thomson Reuters C-Track Breach: When Court System Security Fails
In March 2026, an unauthorized party accessed Thomson Reuters' C-Track court case management platform, exposing sensitive data from courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. The breach, discovered on June 30, 2026, compromised backup files containing Social Security numbers, driver's license numbers, medical information, and sealed court documents. The unauthorized access persisted for nearly four months, affecting critical judicial systems that handle confidential legal proceedings and personal data of court users. This incident highlights the growing threat to government and legal infrastructure, particularly as courts increasingly rely on cloud-based case management systems. With ransomware groups actively targeting government entities and judicial systems becoming prime targets for data theft, this breach underscores the urgent need for enhanced security controls around privileged data access and cloud backup environments.
1 day ago
Kill Chain
ThreatsDay 2026 Attack Analysis: When Social Engineering Meets Cloud Vulnerabilities
The ThreatsDay September 2026 report highlights a sophisticated multi-vector attack campaign featuring CEO-targeted phishing kits, over 5,000 compromised Dropbox accounts, and OAuth authentication bypass techniques. The attacks leveraged social engineering tactics that appeared legitimate, including fake IT support calls, malicious shared files, and trusted application impersonation to gain initial access. Threat actors exploited normal business processes and user trust, making detection extremely difficult. The campaign resulted in widespread credential theft, unauthorized access to cloud storage platforms, and potential data exfiltration across multiple organizations. This incident represents the evolving landscape of sophisticated social engineering attacks that bypass traditional security controls by exploiting human psychology and trusted business processes, highlighting the critical need for zero-trust architectures and enhanced user awareness training.
1 day ago
Kill Chain
AI-Powered Cyber Threats Surge in H1 2026: 215 Exploited Vulnerabilities Signal New Attack Era
The first half of 2026 witnessed a 34% surge in actively exploited vulnerabilities, reaching 215 CVEs compared to 161 in H1 2025. Threat actors increasingly leveraged AI-enabled capabilities to enhance traditional attack methods, with malware like PromptSpy using generative AI for improved persistence and CANFAIL employing LLM-generated decoy logic. Microsoft remained the most targeted vendor with 40 exploited CVEs, while attackers focused on network-accessible vulnerabilities requiring no authentication. The campaign demonstrated how adversaries are blending malicious activities with legitimate tools and trusted services, making detection significantly more challenging. This trend represents a critical evolution in cyber warfare where AI augments rather than replaces established intrusion techniques. Organizations face compressed remediation timelines as AI-assisted vulnerability research accelerates exploit development, while attackers abuse trusted platforms and routine workflows to evade detection systems designed for traditional threat patterns.
1 day ago
Kill Chain
AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining
AWS released a comprehensive incident response guide demonstrating two critical attack scenarios affecting cloud environments in 2025. The first scenario involves a cross-account S3 data deletion attack where threat actors assumed roles from trusted accounts, performed reconnaissance through ListBuckets operations, and executed scripted deletions of financial reports, PII databases, and production backups within a 13-second window. The second scenario showcases cryptocurrency mining operations deployed through AWS CloudFormation, where attackers leveraged console credentials without MFA to create the 'CRYPTO' stack containing EC2 instances for mining operations. Both incidents highlight the sophistication of modern cloud-native attacks that exploit legitimate AWS services and cross-account trust relationships. These attack patterns are increasingly relevant as organizations accelerate cloud adoption while struggling with proper access controls, zero trust implementation, and multi-cloud visibility. The incidents underscore the critical need for enhanced CloudTrail monitoring, cross-account access reviews, and comprehensive egress security policies.
1 day ago
Kill Chain
Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access
A sophisticated multi-stage attack demonstrated how web application vulnerabilities can cascade into unauthorized AI service access across AWS regions. The incident began with a Server-Side Request Forgery (SSRF) vulnerability in a web application that allowed attackers to exploit IMDSv1 endpoints and harvest temporary AWS credentials from an EC2 instance's webdev role. Using these compromised credentials, the threat actor conducted permission boundary testing, established console access without MFA, and ultimately pivoted to Amazon Bedrock services across multiple regions, successfully invoking AI models and consuming computational resources. This attack chain highlights critical gaps in cloud security architecture, particularly the dangerous combination of overprivileged IAM roles, legacy metadata service configurations, and inconsistent cross-region security controls that enabled lateral movement from a simple web vulnerability to unauthorized AI infrastructure access.
1 day ago
Kill Chain
The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected
New research from Echo analyzing nearly 40,000 CVE lifecycles reveals that while AI tools like Anthropic's Claude Mythos have dramatically accelerated vulnerability discovery, the anticipated 'Vulnpocalypse' may be more manageable than feared. Monthly CVE disclosures surged 145% from June 2024 to June 2026, rising from 3,173 to 7,765, with AI enabling exploit development in under one day for less than $2,000. However, fewer than 10% of AI-discovered vulnerabilities receive external validation, and most critical ratings are downgraded upon review. The study found that 89% of examined vulnerabilities already have fixes available, but 40% remain unpatched for over six months due to deployment challenges rather than fix availability. Organizations can better manage this surge by focusing on rapid validation, intelligent prioritization, and automated remediation processes rather than completely overhauling their vulnerability management programs.
1 day ago
Kill Chain
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
In 2026, artificial intelligence is fundamentally transforming the cybercrime landscape by dramatically compressing attack timelines and lowering entry barriers for threat actors. Former cybercriminal Brett Johnson, known as the 'original Internet Godfather' by the US Secret Service, demonstrated at Black Hat USA how AI enables attackers to conduct reconnaissance, identify crown jewels, and execute attacks in significantly reduced timeframes. While defenders still operate reactively, AI empowers criminals to automate target research, vulnerability discovery, and even ransomware development without requiring advanced technical skills. This shift is driving more attackers toward critical infrastructure targets like hospitals and schools, where higher payouts justify the risks. The technology's learning-based nature means it benefits attackers more than defenders, as it must observe successful attacks to improve, creating an inherent advantage for malicious actors in the current threat landscape.
1 day ago
Kill Chain
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
In September 2026, attackers began actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 perimeter devices, enabling unauthenticated remote code execution. CVE-2026-83548, a critical SSRF vulnerability with a CVSS score of 10.0, allows unauthorized access through an unintended alternate access path, while CVE-2026-83549 enables OS command injection. When chained together, these flaws provide complete system compromise of affected appliances running versions 12.4.3-03453/12.5.0-02835 and older. SonicWall confirmed ongoing exploitation and urged immediate patching to versions 12.4.3-03526/12.5.0-02952 or higher. This incident highlights the continued targeting of edge security devices as initial compromise vectors, following a pattern of sophisticated zero-day attacks against network perimeter appliances throughout 2026, emphasizing the critical need for rapid patch management and network segmentation strategies.
1 day ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports