Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 20 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 229–240 / 3490 reports
Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities
Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities
Computer Software/Engineering1 month ago

Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities

In October 2026, the popular Tensorlake npm package was compromised in a sophisticated supply chain attack by the Shai-Hulud worm campaign. Attackers pushed malicious code to version 0.5.144 that harvested credentials from CI environments, Kubernetes clusters, AWS accounts, and developer workstations while establishing persistence and enabling remote code execution. The malware specifically targeted AI development infrastructure, stealing tokens from GitHub, npm, HashiCorp Vault, and configuration files from AI tools like Anthropic Claude and Cursor. The worm also propagated by republishing compromised versions of other packages associated with victims' publishing identities, extending the attack's reach across the JavaScript ecosystem. This incident highlights the growing threat to AI development supply chains as attackers increasingly target machine learning and AI agent infrastructure to extract valuable enterprise data and intellectual property.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
Computer/Network Security1 month ago

MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities

In October 2026, the U.S. Department of Justice charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud for allegedly defrauding ransomware victims by secretly paying ransom demands while claiming to use proprietary decryption tools. Between 2021 and 2023, Pinhasi charged clients over $19 million while secretly paying over $8 million in ransoms to threat actors, marking up fees by 500-1800% above actual ransom costs. In one case, he paid $8,200 to attackers but billed the client $150,000, falsely advertising advanced decryption capabilities that never existed. This case highlights the growing threat of secondary victimization in the ransomware ecosystem, where recovery firms exploit victim desperation. As ransomware attacks surge globally and organizations increasingly turn to third-party recovery services, this incident exposes critical trust gaps in the cybersecurity vendor ecosystem and underscores the need for transparency in incident response partnerships.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
$10 Million Bounty: How HAFNIUM's Exchange Server Attacks Exposed Critical Infrastructure Vulnerabilities
$10 Million Bounty: How HAFNIUM's Exchange Server Attacks Exposed Critical Infrastructure Vulnerabilities
Higher Education/Acadamia1 month ago

$10 Million Bounty: How HAFNIUM's Exchange Server Attacks Exposed Critical Infrastructure Vulnerabilities

The U.S. State Department is offering up to $10 million for information leading to the capture of Zhang Yu, a Chinese national charged in connection with the 2021 HAFNIUM attacks against Microsoft Exchange Server. Zhang, allegedly working as a director at Shanghai Firetech Information Science and Technology under direction from China's Ministry of State Security, coordinated cyberattacks that compromised over 12,700 U.S. organizations between February 2020 and June 2021. The campaign initially targeted COVID-19 vaccine research at universities before exploiting four zero-day Exchange Server vulnerabilities, including ProxyLogon, to conduct widespread espionage operations. This incident remains highly relevant as state-sponsored threat actors continue leveraging zero-day vulnerabilities and contractor networks to obscure attribution while targeting critical infrastructure and intellectual property at unprecedented scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026
Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026
Computer Software/Engineering1 month ago

Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026

Microsoft's FORGE Lab demonstrated significant advances in AI-powered vulnerability research throughout 2026, discovering 140 CVEs in Windows systems and submitting 155 validated reports across 23 open-source projects. Using their multi-model agentic scanning harness (MDASH), the team achieved automated vulnerability discovery at scale, with proof-of-concept generation averaging $3.61 in model costs and 21.5 minutes per Linux kernel finding. The initiative included successful collaboration with the Linux Foundation's Akrites program, resulting in the first Akrites submission to achieve a merged Linux kernel patch. This research represents a paradigm shift in cybersecurity as AI-powered vulnerability discovery transitions from experimental capability to operational reality, fundamentally changing how organizations must approach security validation and remediation at machine speed.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways
SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways
Government Administration1 month ago

SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways

SonicWall disclosed a maximum-severity server-side request forgery (SSRF) vulnerability (CVE-2026-102255) affecting SMA1000 series appliances in October 2026. The flaw exists in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, allowing remote unauthenticated attackers to exploit an unintended alternate access path to direct appliances to issue requests on their behalf and perform unauthorized operations. SonicWall released hotfixes to address the vulnerability, with over 400 Internet-exposed SMA1000 appliances currently tracked by security researchers. This incident underscores the continuing threat to enterprise VPN infrastructure, as SMA1000 appliances have been repeatedly targeted throughout 2026 with multiple zero-day exploits leading to ransomware deployment and custom malware installation across government agencies and large corporations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release
Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release
Computer Software/Engineering1 month ago

Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release

In October 2026, threat actors began exploiting CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability affecting multiple Atlassian products including Jira, Confluence, and Bitbucket. Within hours of watchTowr publishing a detailed technical report and proof-of-concept, Previdian detected active exploitation attempts on their honeypot network. The vulnerability allows attackers to access specific files in the application's web root directory without authentication, and in Crowd-integrated deployments, can escalate to full administrator access by reading plaintext credentials from configuration files. This incident highlights the accelerating timeline from vulnerability disclosure to active exploitation in the modern threat landscape. The rapid weaponization demonstrates how detailed technical research, while valuable for defenders, can be immediately leveraged by threat actors with automated scanning tools and public proof-of-concepts becoming available within hours of disclosure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities
PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities
Information Technology/IT1 month ago

PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities

The PoeLLM cryptomining campaign has compromised over 3,400 AI servers since April 2026, targeting exposed AI services like LiteLLM, Ollama, and Gotenberg PDF converter. The malware uses an innovative command-and-control mechanism, extracting IPv4 addresses from keywords in a poem hosted on GitHub. Once infected, servers become scanning platforms that exploit CVE-2026-42271 and CVE-2026-48710 for unauthenticated remote code execution while mining cryptocurrency through the Kryptex service. Peak activity reached 800 active infected systems in a single day, primarily affecting systems across the United States and Western Europe. This incident highlights the growing threat to AI infrastructure, as these systems often run on powerful GPU clusters with poor security configurations and excessive internet exposure, making them prime targets for cryptomining operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero
The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero
Health Care / Life Sciences1 month ago

The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero

Ransomware groups including ALPHV/BlackCat, BlackMatter, and Gunra have evolved their tactics to specifically target backup infrastructure before encrypting primary systems. In February 2024, ALPHV encrypted Change Healthcare's systems through an unprotected remote access portal, while BlackMatter systematically destroyed NEW Cooperative and Crystal Valley's backup stores using compromised admin credentials. These attacks demonstrate a strategic shift where threat actors eliminate recovery options to maximize ransom payment pressure, with UnitedHealth paying $22 million and still facing $1.6 billion in total recovery costs. This trend reflects the ransomware ecosystem's maturation as attackers recognize that organizations with intact backups rarely pay ransoms. The targeting of backup infrastructure has become standard operating procedure, forcing organizations to fundamentally rethink their recovery strategies and implement immutable storage, network isolation, and credential segregation to maintain viable restoration capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure
FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure
Government Administration1 month ago

FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure

The FBI has issued warnings about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers exploit previously leaked credentials from a massive June 2024 breach affecting 73,932 devices across 194 countries, using distributed GPU clusters to crack stolen password hashes offline. Once inside, threat actors create administrator accounts, delete existing admin access, and establish persistence for lateral movement. The campaign has been linked to INC/Lynx and Payload ransomware operations, with over 86,644 devices now compromised according to SOCRadar. This incident highlights the growing sophistication of credential harvesting operations and the persistent threat of VPN-based initial access brokers feeding the ransomware ecosystem. With attackers now packaging compromised access for sale and targeting organizations based on revenue potential, the FortiBleed campaign represents a significant escalation in organized cybercrime infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates
Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates
Financial Services1 month ago

Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates

In October 2026, threat actors compromised three country-code top-level domains (ccTLDs) - .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) - to obtain unauthorized HTTPS certificates for Google domains. The attackers exploited vulnerabilities in the domain registry infrastructure to issue legitimate SSL/TLS certificates that could be used to impersonate Google services in man-in-the-middle attacks. While Google's own systems remained secure, the incident exposed critical weaknesses in the global DNS and certificate authority ecosystem, potentially affecting millions of users who could be redirected to malicious sites appearing legitimate with valid encryption. This incident highlights the growing sophistication of supply chain attacks targeting internet infrastructure. As threat actors increasingly focus on certificate authorities and DNS registries to bypass traditional security measures, organizations must implement stronger certificate transparency monitoring and adopt zero-trust architectures that verify identity beyond SSL certificates.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances
Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances
Financial Services1 month ago

Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances

SonicWall disclosed four critical vulnerabilities in its SMA1000 appliances on October 6, 2026, including CVE-2026-102255, a maximum CVSS 10.0 pre-authentication server-side request forgery (SSRF) flaw. The vulnerability allows unauthenticated attackers to access internal functionality through the WorkPlace portal, potentially enabling unauthorized operations on the network gateway. Additional vulnerabilities include OS command injection and stored XSS flaws requiring administrator access. SonicWall released hotfixes for affected models 6210, 7210, and 8200v, with no evidence of active exploitation reported. This marks the third instance in 2026 where SonicWall has patched critical pre-authentication SSRF flaws in SMA1000 appliances, highlighting ongoing security challenges in SSL-VPN infrastructure amid the continued expansion of remote work environments and sophisticated nation-state targeting of network perimeter devices.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026
ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026
Financial Services1 month ago

ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026

In October 2026, cybersecurity researchers identified advanced ClickFix social engineering attacks that have evolved to better conceal malicious payloads from security detection systems. Two notable campaigns were discovered: one involving the CrocoRat malware that hides PowerShell commands in DNS TXT records, and another that pre-fetches malicious scripts into browser cache disguised as PNG files. These attacks continue to exploit human trust by presenting fake technical problems or CAPTCHA prompts, instructing victims to paste commands into Windows Run or PowerShell, but now employ sophisticated evasion techniques to bypass initial security defenses. This incident demonstrates the ongoing evolution of social engineering attacks as threat actors adapt to modern security controls. The sophistication of payload concealment techniques reflects attackers' understanding of detection capabilities and their commitment to developing countermeasures that exploit the gap between user trust and technical verification.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports