Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 204 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2437–2448 / 3497 reports
Critical n8n Vulnerabilities Allow Authenticated Remote Code Execution (2026)
Information Technology/IT9 months ago

Critical n8n Vulnerabilities Allow Authenticated Remote Code Execution (2026)

In January 2026, cybersecurity researchers uncovered two critical vulnerabilities in the n8n workflow automation platform, including a CVE-2026-1470 flaw (CVSS 9.9) which enables authenticated users to achieve remote code execution via eval injection. Discovered by the JFrog Security Research team, attackers exploiting these weaknesses could bypass the Expression system and execute arbitrary commands on affected servers. Successful exploitation could allow lateral movement and data exfiltration by leveraging internal automation integrations, putting sensitive business processes and connected services at significant risk. This incident underscores a rising trend of attackers targeting automation and orchestration platforms as high-value footholds in enterprise environments. With the increased adoption of low-code automation, vulnerabilities in such platforms can propagate risk across multiple systems, driving urgent need for software vendors and organizations to prioritize security reviews, patch management, and robust segmentation controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Fake AI Coding Assistant Delivers Malware via VS Code Marketplace in 2026 Supply-Chain Attack
Computer Software/Engineering9 months ago

Fake AI Coding Assistant Delivers Malware via VS Code Marketplace in 2026 Supply-Chain Attack

In January 2026, cybersecurity researchers discovered a malicious Visual Studio Code extension masquerading as "ClawdBot Agent - AI Coding Assistant" in the official VS Code Marketplace. The extension claimed to offer AI-assisted coding functionality but instead delivered a concealed malware payload to users who installed it. The attack leveraged the supply chain vector—abusing trust in a popular development marketplace—and could compromise the local development environment, providing the threat actor with unauthorized access and control over the affected system. This incident highlights the expanding risk of supply-chain attacks in developer ecosystems and raises concerns about the integrity of widely used software distribution platforms. This case underscores a rising trend of threat actors exploiting trusted software repositories to launch targeted malware campaigns. As AI coding assistants and marketplace extensions surge in popularity, organizations face mounting pressure to implement rigorous vetting and monitoring to protect software supply chains from increasingly sophisticated threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SafePay 2025: Ransomware Double-Extortion Escalates Against SMBs
Health Care / Life Sciences9 months ago

SafePay 2025: Ransomware Double-Extortion Escalates Against SMBs

In late 2024 and throughout 2025, the SafePay ransomware group rapidly escalated its operations, launching a string of highly targeted double-extortion attacks against small and mid-sized businesses (SMBs), particularly in highly regulated markets such as the US and Germany. SafePay affiliates compromised victim networks via common attack vectors, exfiltrated sensitive data, and deployed ransomware to encrypt crucial assets. Victims predominantly included service-based companies lacking the resilience to handle operational downtime or public exposure. Attackers leveraged leak sites and aggressive negotiation tactics, threatening regulatory action, legal liability, and reputational damage to compel payment, creating severe business, legal, and financial impacts. This incident exemplifies a broader trend in ransomware: extortion is no longer just about encrypting files, but about exploiting regulatory frameworks and psychological leverage. The rise of fragmented ransomware ecosystems and pressure-centric extortion highlights the need for organizations to move beyond classic recovery strategies and address emerging risks such as data exposure, legal repercussions, and reputational harm.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Stanley Malware: Chrome Web Store Defense Bypassed for Phishing – 2026 Breach Analysis
Computer Software/Engineering9 months ago

Stanley Malware: Chrome Web Store Defense Bypassed for Phishing – 2026 Breach Analysis

In January 2026, security researchers uncovered 'Stanley', a Malware-as-a-Service (MaaS) operation specializing in the distribution of phishing Chrome extensions designed to bypass Google’s official Chrome Web Store review process. Marketed on underground forums, Stanley provides subscribers with malicious browser extensions capable of injecting full-page phishing iframes, silently installing on Chrome, Edge, and Brave, and maintaining persistent command-and-control communication. The malware enables attackers to manipulate users’ browsing sessions while masking the true origin, collect sensitive credentials, and target victims based on IP and geography. This poses a significant risk of data theft and compromise within organizations that rely on browser-based workflows. This incident underscores the growing trend of abusing trusted extension platforms to deliver targeted phishing and credential theft at scale. The ability for criminal actors to bypass established security vetting processes presents urgent challenges for enterprise security teams and highlights the broader concern over supply chain weakness in browser ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Over 6,000 SmarterMail Servers Hijacked via Critical Authentication Bypass (2026)
Information Technology/IT9 months ago

Over 6,000 SmarterMail Servers Hijacked via Critical Authentication Bypass (2026)

In January 2026, over 6,000 SmarterMail servers were found exposed online and vulnerable due to a critical authentication bypass vulnerability (CVE-2026-23760). This flaw in the password reset API allowed unauthenticated attackers to reset administrator passwords, granting them full administrative access and enabling remote code execution on affected servers. Reports of in-the-wild exploitation emerged within days of public disclosure, prompting both mass, automated hijacking attacks and urgent guidance from governmental agencies. The vulnerability impacted organizations globally, particularly across North America and Asia, and posed significant risk to business continuity, privacy, and service integrity. This incident underlines rapid attacker adoption of zero-day vulnerabilities and the risks of delayed patching for internet-exposed business systems. With threat actors leveraging automation and targeting widely-used administrative interfaces, organizations must adopt faster patch cycles and stronger access controls to reduce exposure to similar authentication bypass attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
2026 Fortinet Zero-Day SSO Breach: How Authentication Bypass Exposed Critical Devices
Computer/Network Security9 months ago

2026 Fortinet Zero-Day SSO Breach: How Authentication Bypass Exposed Critical Devices

In January 2026, Fortinet disclosed a critical zero-day vulnerability (CVE-2026-24858) in its FortiCloud SSO authentication mechanism that allowed attackers to bypass security controls and gain unauthorized administrative access to FortiOS, FortiManager, and FortiAnalyzer devices. By leveraging rogue FortiCloud accounts, threat actors exploited an alternate authentication path—even on fully patched systems—to create new local admin and VPN-enabled accounts, exfiltrating firewall configuration data from customer environments within seconds. Fortinet mitigated active attacks by disabling vulnerable FortiCloud SSO connections and initiating global blocks before a patch was available, but over 25,000 devices were at risk during the attack window. This incident is highly relevant due to the growing sophistication and automation of supply chain and SSO-based attacks, with adversaries increasingly targeting trusted cloud management platforms. The event underscores the need for stricter access controls, rapid incident response capabilities, and heightened vigilance around identity infrastructure, especially as SAML and SSO adoption expands in modern enterprises.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cellbreak: Critical Grist-Core Vulnerability Enables Remote Code Execution
Financial Services9 months ago

Cellbreak: Critical Grist-Core Vulnerability Enables Remote Code Execution

In January 2026, a critical vulnerability (CVE-2026-24002, codename Cellbreak, CVSS 9.1) was disclosed in Grist-Core, an open-source spreadsheet-database platform. The flaw enabled attackers to leverage malicious spreadsheet formulas for remote code execution (RCE) on self-hosted Grist-Core servers. This vulnerability could grant adversaries full foothold on affected systems, leading to potential data exfiltration, lateral movement, and operational disruption for organizations running vulnerable deployments. Security researchers at Cyera Research Labs made the discovery public after coordinated disclosure and a patch release by Grist developers. The incident is particularly relevant due to the sharp increase in attacks targeting spreadsheet and application logic vulnerabilities—especially in open-source business tools. As attackers pivot toward supply chain and SaaS entry points, control weaknesses involving user-supplied formulas and embedded code in collaborative apps persist as a high-risk vector.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Office 2026 Zero-Day Forces Emergency Patch After Widespread Exploitation
Financial Services9 months ago

Microsoft Office 2026 Zero-Day Forces Emergency Patch After Widespread Exploitation

In January 2026, Microsoft urgently released an out-of-band security update to address a high-severity zero-day vulnerability, CVE-2026-21509, in Microsoft Office. This security feature bypass flaw allowed attackers to exploit untrusted inputs, enabling unauthorized code execution through manipulated Office documents. The active exploitation of this vulnerability led to significant exposure for organizations relying on Office, making endpoints susceptible to malware deployment and data compromise. Microsoft’s swift emergency patch was in response to in-the-wild attacks observed by security researchers and incident response teams. This incident underscores the persistent threat of zero-day exploits targeting widely used productivity platforms. Attacker tactics are evolving to bypass conventional controls, driving urgency around proactive patch management and advanced threat detection to mitigate business disruption and data loss.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags Five Actively Exploited Vulnerabilities in 2026 KEV Catalog Update
Government Administration9 months ago

CISA Flags Five Actively Exploited Vulnerabilities in 2026 KEV Catalog Update

In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five high-risk vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. These include flaws in the Linux Kernel, SmarterTools SmarterMail, Microsoft Office, and GNU InetUtils. Threat actors exploited these vulnerabilities through methods such as authentication bypass, unrestricted file upload, security feature bypass, and argument injection, targeting both federal and private sector networks. Rapid exploitation can lead to unauthorized access, data exfiltration, or further compromise of organizational systems if not promptly remediated. This evolving threat landscape highlights an ongoing wave of opportunistic and targeted attacks leveraging widely used enterprise, email, and infrastructure software. The addition of these CVEs to the KEV Catalog underscores regulatory pressure and the increased urgency for organizations of all sizes to prioritize patch management and mitigate exposure to active threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know
Information Technology/IT9 months ago

VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know

In January 2026, a critical vulnerability (CVE-2024-37079) in VMware vCenter Server was confirmed as actively exploited in the wild. This heap overflow flaw within the DCERPC protocol implementation enables unauthenticated remote attackers with network access to execute arbitrary code on vulnerable vCenter Server systems. The compromise does not require user interaction or elevated privileges, making attacks relatively low-effort and high-impact. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating all federal agencies to remediate the issue within three weeks, underscoring its urgency and operational risk. No temporary mitigations exist, leaving patching as the sole defense for affected environments. This incident highlights a continued trend of attackers targeting management and orchestration layers in hybrid-cloud and virtualized infrastructures. The lack of workarounds, combined with rapid weaponization, points to increasing risks for organizations who delay patching and underlines regulatory pressure on timely remediation for critical zero-day vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026
Computer Software/Engineering9 months ago

NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026

In January 2026, critical vulnerabilities dubbed "PackageGate" were revealed in NPM and several popular JavaScript package managers, exposing gaps in defenses against supply chain attacks like last year's Shai-Hulud incidents. Despite previous security improvements, attackers could still bypass NPM's safeguard against malicious package scripts by leveraging Git dependencies and malicious .npmrc configuration files, leading to unauthorized code execution—even when script blocking features were enabled. The flaws, discovered by Koi Security researchers, allowed full code compromise and had potential for massive developer credential and secret exfiltration, threatening tens of thousands of projects and their downstream users. These findings highlight the persistent risks in open-source supply chains and the accelerating pace of software supply chain attacks. As threat actors become more adept at exploiting package management tools, organizations face renewed urgency to bolster visibility, enforce granular access controls, and adopt defense-in-depth measures to protect development workflows and critical assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Patches Active Office Zero-Day: What Your Security Team Must Know
Financial Services9 months ago

Microsoft Patches Active Office Zero-Day: What Your Security Team Must Know

In June 2024, Microsoft urgently released security patches addressing a high-severity zero-day vulnerability in Microsoft Office. Threat actors exploited this flaw in-the-wild prior to disclosure, using malicious documents to achieve remote code execution and gain access to targeted systems without user awareness. The vulnerability impacted multiple Office versions, with proof-of-concept exploits circulating even before patch release. Microsoft’s security teams identified active exploitation, prompting swift response to curb potential corporate data exposure, loss of confidentiality, and operational disruption for both private and public sector users worldwide. This incident spotlights the persistent risk of zero-day exploits in mainstream productivity software. It underscores both attackers’ increasing sophistication in rapidly weaponizing new vulnerabilities and the escalating need for organizations to prioritize timely patch application and robust monitoring to mitigate the business impact of emerging threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports