Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 206 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2461–2472 / 3497 reports
VMware vCenter Vulnerability (CVE-2024-37079) Actively Exploited—CISA Issues Immediate Directive
Government Administration9 months ago

VMware vCenter Vulnerability (CVE-2024-37079) Actively Exploited—CISA Issues Immediate Directive

In January 2026, CISA added CVE-2024-37079, a critical out-of-bounds write vulnerability in Broadcom VMware vCenter Server, to its Known Exploited Vulnerabilities (KEV) Catalog due to verified evidence of active exploitation. This flaw enables attackers to execute arbitrary code or cause denial-of-service on affected vCenter deployments, potentially leading to unauthorized access, lateral movement, or data exfiltration. The vulnerability presents a heightened risk to federal agencies and enterprises relying on VMware infrastructure, as attackers frequently target such foundational management servers. The incident underscores escalating threats against widely used virtual infrastructure platforms, with attackers exploiting newly disclosed vulnerabilities before patch adoption. CISA’s rapid update to the KEV Catalog reaffirms urgent regulatory expectations for vulnerability management and highlights the broader necessity for real-time patching and enhanced segmentation to mitigate exploitation risk.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Kimwolf Botnet: How Residential Proxy Infections Fueled a 2025 IoT Crisis
Government Administration9 months ago

Kimwolf Botnet: How Residential Proxy Infections Fueled a 2025 IoT Crisis

In late 2025, the Kimwolf botnet rapidly infected over 2 million IoT devices—primarily unofficial Android TV streaming boxes—by exploiting insecure residential proxy networks, notably those operated by IPIDEA. Kimwolf used these proxies to scan and compromise additional devices on local networks, enabling attackers to conscript them for distributed denial-of-service (DDoS) attacks and other forms of malicious activity, such as ad fraud and data scraping. Investigations by Infoblox and other security firms found Kimwolf infections active across diverse industry sectors worldwide, including healthcare, finance, utilities, and notably, dozens of sensitive government networks. The Kimwolf incident highlights persistent weaknesses in IoT device security, the risks of unmanaged devices on enterprise networks, and the danger posed by residential proxy services abused for malicious purposes. As threat actors increasingly exploit lateral movement via proxy endpoints, organizations in all industries must strengthen segmentation, east-west traffic monitoring, and endpoint visibility to mitigate future outbreaks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Fortinet Firewalls Compromised: 2024 Malicious Configuration Attack Exposes Networks
Financial Services9 months ago

Fortinet Firewalls Compromised: 2024 Malicious Configuration Attack Exposes Networks

In early 2024, threat actors exploited unpatched and even fully patched Fortinet FortiGate firewalls, deploying malicious automation to illicitly access and exfiltrate firewall configuration files. Attackers leveraged vulnerabilities or misconfigurations to automate the compromise of a significant number of devices globally, granting them access to sensitive internal network details, VPN credentials, and administrative information. The targeted manipulation of device configurations allowed for persistent access and posed a risk of lateral movement deeper into enterprise environments. Impacted organizations faced potential exposure of encrypted traffic configurations and gateway policies, undermining both security posture and compliance. This incident is especially relevant as network infrastructure compromises grow more frequent and sophisticated, with attackers rapidly shifting tactics to automate attacks and bypass traditional perimeter defenses. The breach highlights the ongoing challenges organizations face in protecting network infrastructure against highly motivated and well-resourced threat actors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI Agents Breach Simulated Enterprise via Open-Source Tools: Claude Sonnet 4.5 Equifax-Style Attack
Financial Services9 months ago

AI Agents Breach Simulated Enterprise via Open-Source Tools: Claude Sonnet 4.5 Equifax-Style Attack

In January 2026, researchers demonstrated that the latest Anthropic Claude Sonnet 4.5 AI model could autonomously breach simulated enterprise networks using only standard, open-source tools without custom malware or frameworks. During testing, the AI model rapidly identified and exploited an unpatched, publicized vulnerability to exfiltrate sensitive (simulated) personal data, mimicking tactics similar to the original Equifax breach. This exercise revealed how advanced AI agents now lower the technical barriers for rapid, multistage cyberattacks, enabling them to recognize and exploit vulnerabilities far faster than manual attackers. This incident underscores the accelerating risk posed by AI-powered offensive cyber capabilities. The proliferation of autonomous cyber agents marks a turning point, driving urgent regulatory, corporate, and operational focus on timely patch management, zero trust architectures, and advanced detection to stay ahead of next-generation threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Russian Ransomware Leader Brought to Justice: Lessons from the Antropenko Case
Financial Services9 months ago

Russian Ransomware Leader Brought to Justice: Lessons from the Antropenko Case

Between 2018 and August 2022, Ianis Aleksandrovich Antropenko led a prolific ransomware operation targeting at least 50 victims across various sectors, causing losses exceeding $1.5 million. Operating from both Russia and later the United States, Antropenko leveraged variants like Zeppelin and GlobeImposter, coordinating with co-conspirators—including his ex-wife—to deploy ransomware, extort victims, and launder proceeds through a network of global accounts and crypto wallets. His arrest and subsequent guilty plea follow a multi-year investigation by U.S. federal authorities, resulting in the seizure of more than $3 million in assets. This case highlights the growing trend of ransomware group leaders operating internationally and even within U.S. borders, challenging traditional law enforcement approaches. It underscores persistent ransomware risk, ongoing challenges in detecting coordinated laundering activity, and the critical need for comprehensive security controls and compliance vigilance.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Fortinet 2026 Breach: Authentication Bypass Leads to Firewall Configuration Theft
Financial Services9 months ago

Fortinet 2026 Breach: Authentication Bypass Leads to Firewall Configuration Theft

In January 2026, Fortinet FortiGate devices became the target of a coordinated cyberattack exploiting an authentication bypass vulnerability (CVE-2025-59718) associated with the FortiCloud SSO feature. Attackers accessed vulnerable firewalls, created rogue administrative accounts, and swiftly exfiltrated firewall configuration data using automated tools, demonstrating significant threat actor sophistication. Reports indicated the campaign began on January 15, 2026, and quickly escalated as even patched devices were compromised—suggesting a patch bypass or incomplete remediation. Affected organizations faced exposure of sensitive security configurations and heightened risk of follow-on breaches or lateral movement within their networks. This incident spotlights the urgent challenges posed by cloud-exposed assets and incomplete vulnerability remediation. It emphasizes the criticality of rapid patch cycles, zero trust principles, and robust monitoring amid a trend of identity and configuration–focused attacks targeting enterprise infrastructure platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Okta SSO Targeted: 2024 Vishing Surge Exposes Credential Gaps
Financial Services9 months ago

Okta SSO Targeted: 2024 Vishing Surge Exposes Credential Gaps

In early 2024, Okta Single Sign-On (SSO) user accounts became the target of sophisticated phishing campaigns leveraging custom voice-based social engineering (vishing) kits. Threat actors contacted employees via phone calls, impersonating IT staff and using convincing pretexts to direct users to phishing sites tailored to mimic Okta’s authentication workflow. By capturing the credentials and multi-factor authentication (MFA) tokens, attackers accessed sensitive enterprise environments, leading to data exfiltration, disruption of operations, and potential exposure of downstream customers relying on Okta SSO for access control. This incident highlights a broader escalation in the use of vishing tactics to bypass strong authentication, underscoring the ongoing shift toward highly targeted, voice-enabled phishing attacks. Enterprises must adapt security and training programs to confront increasingly sophisticated social engineering methods targeting identity infrastructures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
INC Ransomware OpSec Fail Uncovers Data from 12 U.S. Organizations
Health Care / Life Sciences9 months ago

INC Ransomware OpSec Fail Uncovers Data from 12 U.S. Organizations

In January 2026, an operational security lapse in the INC ransomware group's infrastructure enabled Cyber Centaurs researchers to recover encrypted data exfiltrated from twelve U.S. organizations. The investigation began after a RainINC ransomware attack on a client’s production SQL Server. Forensic analysis traced renamed binaries, PowerShell scripts, and usage of the Restic backup tool, revealing attacker scripts with hardcoded credentials and references to persistent cloud storage. By enumerating the attacker-controlled repositories, researchers identified encrypted data from healthcare, manufacturing, technology, and services firms, then decrypted and preserved it in coordination with law enforcement. This case highlights a rare opportunity where attacker mistakes allowed post-breach data retrieval for unrelated victim organizations. The incident underscores a growing trend in ransomware operations leveraging legitimate backup and exfiltration tools, persistent attacker infrastructure, and the importance of thorough incident response for uncovering wider impacts.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
SmarterMail Auth Bypass Allows Attackers to Reset Admin Accounts in Live Exploits
Information Technology/IT9 months ago

SmarterMail Auth Bypass Allows Attackers to Reset Admin Accounts in Live Exploits

In January 2026, attackers began exploiting an authentication bypass vulnerability in SmarterTools’ SmarterMail email server platform, which enabled unauthenticated users to reset admin account passwords and seize full system control. The flaw, residing in a publicly-exposed API endpoint allowing forced resets with attacker-supplied JSON, let threat actors escalate privileges by resetting admin credentials, paving the way to remote code execution. The vulnerability was disclosed in early January, patched on January 15, and observed in active exploitation just days later as attackers reverse-engineered the fix to target unpatched servers globally. This incident draws attention to the criticality of prompt patch management and highlights the ongoing risk of API flaws being rapidly weaponized post-disclosure. It underscores a broader trend of attackers targeting authentication controls in business-critical SaaS and infrastructure applications, raising regulatory and operational pressure for stronger access security and rapid response procedures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)
Computer/Network Security9 months ago

Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)

In January 2026, threat actors exploited misconfigured web applications used for security testing and internal penetration testing—such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP—publicly exposed by Fortune 500 companies and major security vendors. By targeting these intentionally vulnerable apps tied to overly privileged cloud accounts in AWS, GCP, and Azure, attackers gained unauthorized access, deployed Monero (XMR) crypto miners, planted persistent webshells, and pivoted to sensitive cloud assets. Over 1,900 instances were found online, many with default credentials and excessive permissions, exposing secrets and allowing full access to cloud resources including storage buckets and Secrets Manager. Victim organizations remediated after being notified. This incident highlights a growing attack pattern where "friendly" security test and training tools become high-risk assets when mismanaged in cloud environments. Their exploitation underscores pressing gaps in cloud inventory management, IAM least-privilege enforcement, and secret sprawl, at a time of escalating attacks exploiting cloud misconfiguration and supply chain weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Why Even Security Pros Get Phished: The Human & AI-Powered Phishing Crisis of 2026
Financial Services9 months ago

Why Even Security Pros Get Phished: The Human & AI-Powered Phishing Crisis of 2026

In January 2026, multiple incidents highlighted how even vigilant individuals and cybersecurity professionals are susceptible to highly convincing phishing attacks. Attackers leveraged advanced social engineering techniques and sophisticated phishing-as-a-service (PhaaS) platforms, often enhanced by AI-driven content generators such as PhishGPT, to deliver targeted messages via email, SMS, and collaboration tools. These lures bypassed traditional defenses, exploiting moments of distraction or emotional vulnerability to harvest sensitive information including credentials and payment data. The operational impact ranged from financial loss and credential compromise to downstream business risk due to unauthorized access or fraud. The incident typifies the evolution of phishing as an industrialized, scalable ecosystem that increasingly relies on automation, AI-tailored content, and a broadening array of tactics. As these methods proliferate and become accessible to attackers with limited technical skills, organizations face heightened regulatory, operational, and reputational risks, making effective prevention and user awareness more vital than ever.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts
Financial Services9 months ago

Phishing Campaign Exploits LastPass Users with Fake Vault Backup Alerts

In January 2026, LastPass warned users of a sophisticated phishing campaign impersonating official maintenance notifications, urging recipients to back up their password vaults within 24 hours. Attackers crafted convincing emails from spoofed senders with subjects stressing urgency, redirecting victims to a phishing site designed to harvest master passwords or hijack accounts. The campaign coincided with a U.S. holiday weekend, likely aiming to exploit periods of reduced staffing for more effective compromise. The prompt and widespread phishing attempt risked exposure of highly sensitive personal and business credentials, threatening downstream impacts and increased support demand for affected users and organizations. This incident highlights the ongoing evolution of credential harvesting campaigns and demonstrates how adversaries exploit times of operational vulnerability. The use of realistic messages and urgency tactics exemplifies broader trends in social engineering, reinforcing the necessity for user education, resilient authentication practices, and rapid response protocols to counteract increasingly common and dangerous phishing threats targeting password managers.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports