Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 205 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2449–2460 / 3497 reports
Malicious AI-Powered VS Code Extensions Trigger Global Supply Chain Breach (2026)
Computer Software/Engineering9 months ago

Malicious AI-Powered VS Code Extensions Trigger Global Supply Chain Breach (2026)

In January 2026, cybersecurity researchers uncovered that two widely-distributed AI-powered Microsoft Visual Studio Code extensions, with over 1.5 million combined installs, were covertly exfiltrating developer source code and sensitive project data to servers based in China. The malicious extensions masqueraded as legitimate AI coding tools, enticing developers globally through the official VS Code marketplace. Once installed, these extensions surreptitiously uploaded confidential code and intellectual property, potentially endangering enterprise software assets and customer data. Investigators highlighted the supply chain risk, noting the threat’s scalability via trusted software distribution channels and the delays in detecting such activity. This incident underscores the escalating risks associated with third-party development tools, particularly those leveraging AI branding. The popularity and trust in official marketplaces can allow sophisticated advanced persistent threats (APTs) or criminal groups to exploit developers and organizations, necessitating enhanced scrutiny and continuous security monitoring of supply chain dependencies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Exposed Environment Files: The $(pwd) Webserver Reconnaissance Surge of Jan 2026
Computer Software/Engineering9 months ago

Exposed Environment Files: The $(pwd) Webserver Reconnaissance Surge of Jan 2026

In January 2026, multiple sensors and the SANS Internet Storm Center reported a wave of targeted web application scans probing for exposed environment and configuration files on webservers using the /$(pwd)/ path pattern. Attackers, active since at least January 13th, systematically searched for sensitive files such as .env, docker-compose.yml, and terraform.tfstate, potentially exposing credentials and secrets. Two identified IP addresses (185.177.72.52, 185.177.72.23) led these scans, illustrating an automated approach likely leveraging misconfigured servers. While no confirmed breaches have been disclosed, such activity significantly raises the risk of follow-on exploitation or credential theft if vulnerable files are found. This incident highlights growing attacker sophistication in discovering misconfigurations and automating reconnaissance. The use of predictable directory traversal patterns and attempts to surface hidden files underscore the need for robust web application hardening and monitoring, especially as threat actors increasingly leverage similar tactics to bypass traditional defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
ShinyHunters 2026: SSO Vishing Attacks Trigger Major SaaS Data Breaches
Financial Services9 months ago

ShinyHunters 2026: SSO Vishing Attacks Trigger Major SaaS Data Breaches

In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice-phishing (vishing) attacks targeting corporate Single Sign-On (SSO) platforms, including Okta, Microsoft Entra, and Google. The attackers posed as IT support staff, manipulated employees into entering their credentials and multi-factor authentication tokens on fake login pages, and subsequently gained unauthorized access to SSO accounts. Leveraging these credentials, ShinyHunters accessed numerous connected SaaS applications such as Salesforce, Microsoft 365, and Slack, harvesting sensitive corporate data that was later used for extortion demands. High-profile organizations like SoundCloud, Betterment, and Crunchbase reported breaches and data losses as a result. This incident underscores a significant evolution in social engineering tactics, with attackers combining real-time phishing kits and vishing to bypass MFA and access a wide swath of corporate resources. As threat actors increasingly exploit identity-driven weaknesses and leverage SSO misconfigurations, organizations face greater risks of multi-system compromise and regulatory fallout.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Russian Organizations Hit by Advanced Multi-Stage Phishing with Amnesia RAT and Ransomware
Financial Services9 months ago

Russian Organizations Hit by Advanced Multi-Stage Phishing with Amnesia RAT and Ransomware

In January 2026, a sophisticated multi-stage phishing campaign targeted Russian organizations, leveraging social engineering emails that contained tampered business documents. These lures delivered a remote access trojan (Amnesia RAT) alongside ransomware, allowing attackers to establish stealthy persistence and ultimately encrypt sensitive data for extortion. The threat actors employed layered infection chains, executed lateral movement within infected environments, and exfiltrated critical information before deploying ransomware. The attack resulted in operational disruptions and financial risk for affected businesses. This incident reflects an escalating trend of multi-vector threats where initial phishing access rapidly pivots to advanced malware implants and ransomware. Security leaders must recognize the evolving sophistication and automation in phishing and malware delivery, and reinforce layered defenses, monitoring, and incident response to counter multi-stage cyber attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
CISA Urgently Flags Critical VMware vCenter Vulnerability (CVE-2024-37079) Amid Active Exploitation
Information Technology/IT9 months ago

CISA Urgently Flags Critical VMware vCenter Vulnerability (CVE-2024-37079) Amid Active Exploitation

In June 2024, a critical heap overflow vulnerability (CVE-2024-37079) affecting Broadcom VMware vCenter Server was identified and patched, but active exploitation was confirmed shortly thereafter. On January 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog after evidence surfaced of attackers leveraging the bug to execute unauthorized code remotely. Malicious actors could use this exploit to gain privileged access, conduct lateral movement, and potentially exfiltrate sensitive data or disrupt operations in environments utilizing unpatched vCenter servers. The incident underscores the continued targeting of core virtualization infrastructure by sophisticated threat actors and ransomware groups. With threat actors rapidly exploiting newly disclosed vulnerabilities, unpatched critical systems are at heightened risk, prompting urgency for patch management and layered security controls across enterprise environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Cisco Zero-Day Flaw Sparks Mass Exploitation of Unified Communications Platforms
Telecommunications9 months ago

Cisco Zero-Day Flaw Sparks Mass Exploitation of Unified Communications Platforms

In early June 2026, Cisco disclosed a critical zero-day vulnerability (CVE-2026-20045) impacting its Unified Communications (UC) suite, which quickly became the target of mass automated exploitation. Threat actors leveraged the flaw to gain remote code execution, potentially allowing them to fully compromise UC servers and pivot into broader enterprise networks. The scale of the vulnerability—affecting millions of devices worldwide—prompted urgent alerts from security agencies and rapid patching actions by global organizations. Successful intrusions could enable attackers to intercept sensitive communications, exfiltrate data, and disrupt business operations. This incident is especially notable as zero-day attacks against high-availability collaboration infrastructure have surged, reflecting a broader trend in targeting business-critical communication platforms. The Cisco exploitation underscores the speed at which adversaries now weaponize new flaws, and the risks posed to organizations lacking robust patch and segmentation defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026
Financial Services9 months ago

Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026

In January 2026, Fortinet confirmed the existence of a critical authentication bypass (CVE-2025-59718) affecting its FortiCloud SSO feature, leaving fully patched devices vulnerable to compromise. Attackers exploited a patch bypass to gain administrative access, quickly creating VPN-enabled accounts and exfiltrating firewall configurations. Despite an earlier advisory, threat actors continued to exploit an unaddressed attack path, with the campaign becoming automated and impacting organizations globally. Evidence included unauthorized logins and suspect account creation, prompting urgent investigation and forensic response from network teams. This breach illustrates the growing risk posed by incomplete patches and the relentless pursuit by attackers of residual vulnerabilities, particularly in widely deployed network security products. It underscores the critical need for continuous monitoring, rapid patch validation, and limiting administrative access to sensitive management interfaces.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Malicious AI Extensions in VSCode Marketplace Steal Developer Data, Impacting 1.5 Million Users
Computer Software/Engineering9 months ago

Malicious AI Extensions in VSCode Marketplace Steal Developer Data, Impacting 1.5 Million Users

In January 2026, researchers at Koi Security discovered that two AI-powered Visual Studio Code (VSCode) Marketplace extensions—ChatGPT – 中文版 and ChatMoss (CodeMoss)—were secretly exfiltrating developer files and sensitive data to China-based servers. Together, these malicious extensions had been installed 1.5 million times and collected data using real-time file monitoring, workspace file harvesting, and covert user profiling via embedded commercial analytics SDKs. The compromised extensions transmitted not only source code but potentially included API keys, configuration, and credential files without user consent, representing a major supply-chain compromise in the software development ecosystem. This incident highlights the persistent risks developers face from supply chain attacks through third-party plugins. As AI-driven code assistants surge in popularity, attackers are increasingly exploiting trusted extension marketplaces to deploy sophisticated data-stealing campaigns, raising urgent concerns for software security, compliance, and marketplace governance.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)
Computer Software/Engineering9 months ago

AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)

In January 2026, Intruder Security revealed an application security vulnerability in their intentionally vulnerable honeypot, stemming from AI-generated code that mishandled client-supplied IP headers. The AI-assisted system incorrectly trusted IP values in HTTP headers without enforcing a trust boundary, allowing attackers to inject payloads or spoof source IP information. This oversight, undetected by common static analysis tools, resulted in attacker-controlled inputs influencing system logic, posing potential risks for local file disclosure or server-side request forgery had the vulnerable code path been used differently. While the actual impact remained low due to the isolated nature of the honeypot, the incident highlights significant gaps in current AI-assisted development and security review processes. This event underscores the growing prevalence of AI-generated vulnerabilities and the limitations of automated security tools in identifying nuanced flaws. As enterprises increasingly rely on AI-driven coding and automation, such oversights are likely to become more common, emphasizing the need for robust validation and updated security governance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Fortinet Zero-Day SSO Bypass Targets Fully Patched Firewalls in 2026
Financial Services9 months ago

Fortinet Zero-Day SSO Bypass Targets Fully Patched Firewalls in 2026

In January 2026, Fortinet confirmed that attackers actively exploited a new authentication bypass vulnerability affecting FortiCloud SSO on fully patched FortiGate firewalls. Despite organizations applying the latest security updates, adversaries used an undisclosed flaw to circumvent authentication protections, gaining unauthorized administrative access to network infrastructure. The incidents were detected within 24 hours of the latest firmware deployment, leading to compromised management interfaces and potentially broad security implications for affected enterprises utilizing FortiCloud SSO for remote management and single sign-on. This breach underscores a persistent challenge in cloud-managed network security: even well-maintained, up-to-date systems may be vulnerable to zero-day exploits. The event highlights increased attacker focus on SSO and management plane weaknesses, as well as the importance of layered defenses, rapid detection, and coordinated response in modern enterprise security architecture.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
CISA Flags Four Actively Exploited Vulnerabilities: 2026 Software Risk Alert
Government Administration9 months ago

CISA Flags Four Actively Exploited Vulnerabilities: 2026 Software Risk Alert

In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog to include four new software flaws confirmed as actively exploited in the wild. Among these, CVE-2025-68645 in the Synacor Zimbra Collaboration Suite enables remote file inclusion through a PHP vulnerability, presenting severe risks of remote code execution and unauthorized access. Attackers have been leveraging these vulnerabilities to infiltrate enterprise and government infrastructures, resulting in the exposure of sensitive data and disruption of critical collaboration services. This incident exemplifies the accelerating pattern of opportunistic exploitation by cybercriminals and state-backed actors who quickly weaponize disclosed vulnerabilities. It highlights the urgent need for timely patching, robust segmentation, traffic monitoring controls, and adherence to regulatory frameworks such as HIPAA, PCI DSS, and NIST to effectively mitigate operational risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How Stolen Credentials Enabled Stealthy LogMeIn RMM Attacks in 2026
Information Technology/IT9 months ago

How Stolen Credentials Enabled Stealthy LogMeIn RMM Attacks in 2026

In January 2026, researchers reported a campaign where attackers leveraged phishing emails to steal valid user credentials, allowing them to deploy legitimate LogMeIn Remote Monitoring and Management (RMM) software for covert, persistent access to corporate systems. By utilizing IT tools typically trusted by administrators rather than custom malware, the adversaries successfully bypassed traditional security measures and gained unrestricted access to sensitive business environments. The campaign underscores the increasing sophistication of credential-based attacks and the risks posed by the misuse of legitimate remote access tools. This incident is vital in the current cybersecurity landscape as it exemplifies the growing threat of identity-driven attacks and the exploitation of trusted IT software. Organizations face mounting regulatory and operational pressure to enforce zero trust principles and segment internal traffic, as traditional perimeter defenses and malware-centric detection are increasingly ineffective against modern attacker tactics.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports