Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 209 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2497–2508 / 3497 reports
StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack
Information Technology/IT9 months ago

StackWarp: AMD’s Hardware Flaw Exposes Confidential Cloud VMs to Attack

In January 2026, researchers disclosed a vulnerability called StackWarp, affecting AMD’s Zen 1 through Zen 5 processor lines, including EPYC models widely used in cloud and enterprise environments. The flaw (CVE-2025-29943) enables privileged threat actors on host servers to manipulate the stack pointer of guest memory in confidential virtual machines (CVMs) secured with AMD SEV-SNP. By exploiting a previously undocumented control bit, attackers can redirect program flow inside targeted VMs, leading to remote code execution, privilege escalation, and exposure of sensitive assets such as cryptographic keys or kernel privileges. AMD published mitigations and microcode updates in July and October 2025, with additional firmware patches pending. This incident is a compelling example of the persistent risks stemming from microarchitectural attacks bypassing virtualization and memory encryption boundaries. As supply chain, multi-tenant cloud, and confidential computing adoption increases, organizations should regularly assess hardware-layer exposures and stay current on firmware updates to limit high-impact cascades.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign
Financial Services9 months ago

CrashFix Chrome Extension Attack Delivers ModeloRAT in ClickFix-Style Campaign

In January 2026, security researchers uncovered the 'KongTuke' campaign, which weaponized a malicious Chrome extension named CrashFix, disguised as an ad blocker. Attackers exploited a faux browser crash workflow—imitating ClickFix lures—to trick victims into running malicious commands, delivering the new ModeloRAT remote access trojan (RAT). The campaign allowed threat actors to silently gain persistent, covert access, facilitating lateral movement and potential data exfiltration within corporate environments. The incident highlights the evolving sophistication of browser-based attack chains and underscores browser extension risk as a modern threat vector for organizations reliant on SaaS and web apps. This breach is emblematic of a surge in malicious browser extensions delivering advanced malware. It showcases a growing trend toward supply chain compromise and the abuse of user trust in widely used browser platforms, calling for improved extension vetting and proactive security controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
How an XSS Bug in StealC Malware Panel Unmasked Threat Actors in 2026
Financial Services9 months ago

How an XSS Bug in StealC Malware Panel Unmasked Threat Actors in 2026

In January 2026, cybersecurity researchers exploited a cross-site scripting (XSS) vulnerability in the StealC information stealer's web-based control panel. By leveraging this flaw, they monitored active threat actor sessions, collected system fingerprints, and obtained critical intelligence on StealC's illicit operations. The StealC malware, known for targeting credentials and sensitive data from infected endpoints, was actively managed via this compromised control panel by cybercriminal operators. As a result of this research, defenders gained unprecedented visibility into threat actor workflow and TTPs, turning a malicious tool’s own infrastructure against its controllers. This incident highlights the growing focus on attacking the infrastructure of threat actors themselves, signifying a shift in defensive strategies. Vulnerabilities within criminal tooling and panels can be weaponized by blue teams to gain actionable threat intelligence, reflecting broader trends in intrusion analysis and adversary disruption.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Fortinet 2026: How RedLine Clipjack and Copilot Shaped a New Breed of Multi-Vector Attacks
Financial Services9 months ago

Fortinet 2026: How RedLine Clipjack and Copilot Shaped a New Breed of Multi-Vector Attacks

In early 2026, multiple organizations suffered a multi-vector cyberattack campaign leveraging Fortinet device vulnerabilities, RedLine stealer variants with clipjack capabilities, and weaponized Copilot-integrated phishing. Threat actors gained initial access through unpatched Fortinet appliances, moved laterally via east-west traffic, and deployed RedLine malware to intercept credentials and exfiltrate sensitive data. The attackers further abused cloud AI tools to automate reconnaissance and launch targeted campaigns, leading to significant data compromise and operational disruption across cloud and hybrid environments. This incident underscores an accelerating trend: attackers are combining zero-day exploits, infostealers, and AI-driven automation to bypass traditional defenses. As threat actors become more agile and creative with emerging tools, organizations face growing pressure to secure east-west flows and implement real-time anomaly detection to mitigate multi-stage breaches.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Fortinet FortiSIEM CVE-2025-64155: Critical Vulnerability Exploited in the Wild
Financial Services9 months ago

Fortinet FortiSIEM CVE-2025-64155: Critical Vulnerability Exploited in the Wild

In June 2025, Fortinet disclosed CVE-2025-64155, a critical command injection vulnerability affecting FortiSIEM, its security information and event management solution. Attackers began exploiting the flaw almost immediately after disclosure, leveraging it to execute unauthorized system commands and gain persistent access across multiple targeted networks. Malicious activity was detected from a diverse array of IP addresses, suggesting widespread probing and potential compromise. The rapid weaponization of the vulnerability placed organizations relying on FortiSIEM at risk of data exfiltration, lateral movement, and potential service disruption, underscoring the importance of timely patch management and layered defenses. This incident is emblematic of a growing trend where attackers aggressively target newly disclosed vulnerabilities in widely used security platforms. The event highlights the urgent need for rapid vulnerability response processes and reevaluation of vendor risk in security-critical infrastructure, as threat actors continue to automate exploitation of critical flaws in security tooling itself.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Inside the 2024 Payroll Social Engineering Breach: Lessons from the Payroll Pirates
Human Resources/HR9 months ago

Inside the 2024 Payroll Social Engineering Breach: Lessons from the Payroll Pirates

In early 2024, a major payroll provider experienced a sophisticated social engineering breach orchestrated by attackers dubbed the 'Payroll Pirates.' The threat actors engineered convincing phishing campaigns targeting payroll staff, tricking them into divulging critical credentials. Once initial access was secured, the attackers leveraged lateral movement techniques to escalate privileges and manipulate internal payroll processes, ultimately leading to fraudulent fund transfers and sensitive data exposure. Rapid detection efforts limited further impact, but the breach resulted in financial losses, operational disruption, and increased scrutiny over internal controls. This incident underscores the resurgence of highly targeted social engineering attacks, specifically in the payroll and finance sectors. As attackers blend human manipulation with advanced technical tactics, organizations must prioritize zero trust architectures, staff awareness, and continuous threat monitoring to defend against this evolving risk landscape.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Pixel 9's 2025 Zero-Click Exploit Chain: Lessons in Mobile Supply Chain Security
Telecommunications9 months ago

Google Pixel 9's 2025 Zero-Click Exploit Chain: Lessons in Mobile Supply Chain Security

In 2025, security researchers demonstrated a critical 0-click exploit chain targeting Google Pixel 9 and other Android devices, leveraging vulnerabilities in the Dolby UDC audio codec and the BigWave driver. Attackers could remotely execute code without user interaction by exploiting flaws in audio file processing and privilege escalation within device drivers. Despite early reporting and clear exploitability, it took vendors up to 139 days to release patches, leaving millions of Android users at risk. Gaps in patch management, inconsistent security controls, and delayed vulnerability classification contributed to prolonged exposure and a significant operational risk. This incident underscores the urgency of promptly addressing zero-click vulnerabilities and supply chain security issues in mobile ecosystems. As attackers increasingly exploit overlooked decoders, device drivers, and rapidly introduced AI features, coordinated patching and proactive privilege reduction remain essential to counter evolving mobile threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fortinet FortiSIEM Zero-Day: Exploitation Surge Exposes SIEM Risks in 2024
Financial Services9 months ago

Fortinet FortiSIEM Zero-Day: Exploitation Surge Exposes SIEM Risks in 2024

In June 2024, attackers began actively exploiting a critical vulnerability (CVE-2024-XXXX) in Fortinet FortiSIEM, a widely deployed security event management solution. The flaw, which allows remote code execution via specially crafted API requests, was leveraged soon after public proof-of-concept exploit code emerged. Threat actors targeted unpatched FortiSIEM instances to gain privileged access, deploy malware, and establish persistence within enterprise environments, impacting security visibility and putting sensitive data at risk. Public advisories highlighted patch urgency, as exploitation was observed globally in both private and government sectors. This incident underscores sharp escalation in exploitation of high-impact vulnerabilities immediately following public disclosure and POC release. The attack illustrates the need for rapid patching, robust segmentation, and comprehensive monitoring, as threat actors increasingly automate targeting of critical management infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Black Basta Ransomware Boss Named, Placed on Interpol Red Notice in Major 2026 Crackdown
Health Care / Life Sciences9 months ago

Black Basta Ransomware Boss Named, Placed on Interpol Red Notice in Major 2026 Crackdown

In January 2026, international law enforcement, led by Ukraine and Germany, identified Oleg Evgenievich Nefedov as the leader of the Black Basta ransomware-as-a-service (RaaS) gang. Authorities added Nefedov to Interpol's 'Red Notice' and Europol's 'Most Wanted' lists, following coordinated raids that apprehended affiliates specializing in breaching corporate systems, cracking passwords, and escalating privileges to facilitate attacks. Black Basta has been attributed to over 600 global cyber incidents targeting enterprises in sectors from defense to healthcare, employing ransomware and data extortion to extract payments and exfiltrate sensitive information. This incident is significant as it marks one of the first times a major ransomware operation's leadership was officially unmasked and targeted with international warrants. The Black Basta takedown reflects increasing sophistication and coordination in responses to organized cybercrime, underscoring the persistent threat posed by ransomware groups and their rapid evolution post-Conti.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
China-Linked APT Exploits Cisco Secure Email Gateway Zero-Day (2025)
Government Administration9 months ago

China-Linked APT Exploits Cisco Secure Email Gateway Zero-Day (2025)

In late 2025, Cisco disclosed a critical zero-day vulnerability (CVE-2025-20393, CVSS 10.0) within AsyncOS Software powering its Secure Email Gateway and Secure Email and Web Manager appliances. Exploited by China-linked advanced persistent threat group UAT-9686, the flaw—residing in insufficient HTTP request validation by the Spam Quarantine feature—allowed attackers to remotely execute commands as root, install tunneling and persistence tools, and drop a Python backdoor ("AquaShell"). The threat actor’s campaign saw exploitation in the wild ahead of Cisco’s January 2026 patch release, impacting organizations exposing affected appliances to the internet with the vulnerable feature enabled. This incident highlights the increasing sophistication and operational tempo of state-backed APTs exploiting zero-day vulnerabilities in enterprise infrastructure. The case underscores the urgency for rigorous patch management, network segmentation, and rapid detection as attackers target critical security appliances that serve as organizational communication lifelines.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GootLoader’s Malformed ZIP Attack: 2026 Lessons for Enterprise Security
Law Practice/Law Firms9 months ago

GootLoader’s Malformed ZIP Attack: 2026 Lessons for Enterprise Security

In January 2026, security researchers uncovered a sophisticated GootLoader malware campaign leveraging malformed, hashbusting ZIP archives containing JavaScript payloads. These ZIP files, crafted by concatenating 500–1,000 archives and manipulating ZIP header fields, evaded analysis from most extraction tools except Windows' default unarchiver. Distributed via SEO poisoning and malvertising targeting legal template seekers, the attack delivered unique archives to each victim, successfully bypassing many detection workflows. Once executed, the JavaScript payload established persistence and launched additional scripts to gather system info and await remote instructions—potentially leading to further infections, including ransomware. This incident underscores the rising technical sophistication in malware delivery tactics, with adversaries rapidly adapting to security controls by exploiting common utilities and unique, randomized delivery artifacts. The campaign highlights the need for proactive endpoint controls and continuous monitoring, as many legacy detection and response tools may miss such creative evasion methods.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Predator Spyware: Inside Intellexa’s Vendor-Controlled C2 Attack Tactics (2024)
Government Administration9 months ago

Predator Spyware: Inside Intellexa’s Vendor-Controlled C2 Attack Tactics (2024)

In early 2024, cybersecurity researchers uncovered evidence of Predator, a commercial spyware platform developed by Intellexa, leveraging a vendor-controlled command-and-control (C2) infrastructure to improve attack precision. Failed and thwarted infection attempts were systematically analyzed by the vendor to refine future attack methods, highlighting a professionalized feedback loop in commercial spyware campaigns. The attack vectors included advanced mobile device exploits, with malicious payloads deployed on targeted mobile devices through phishing or exploit links. The incident underscores how commercial spyware vendors adapt rapidly by learning from failed compromises, posing significant operational risk to both individuals and organizations globally. The exposure of Predator's vendor-controlled C2 approach signals a broader industry shift toward more dynamic, resilient spyware operations, complicating detection and defense for enterprises. This incident exemplifies the rise of highly adaptive, commercially-driven attack infrastructure, intensifying regulatory, technical, and reputational challenges for security leaders and organizations handling sensitive data.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports