Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 21 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 241–252 / 3490 reports
Healthcare's Quantum Vulnerability Crisis: 94% of Medical Devices Lack Quantum-Safe Encryption
Healthcare's Quantum Vulnerability Crisis: 94% of Medical Devices Lack Quantum-Safe Encryption
Health Care / Life Sciences1 month ago

Healthcare's Quantum Vulnerability Crisis: 94% of Medical Devices Lack Quantum-Safe Encryption

A comprehensive study by Forescout Technologies analyzing 2.5 million devices across 50+ healthcare organizations revealed critical gaps in post-quantum cryptography (PQC) readiness throughout the healthcare sector. The research found that only 50% of IT devices support PQC-capable SSH implementations, while operational technology devices lag at 16% and Internet of Medical Things (IoMT) devices at a mere 6%. Most concerning, over 5,500 Internet-exposed healthcare systems containing electronic medical records and imaging data showed only 31% adoption of TLS 1.3, the foundation for standardized post-quantum cryptography. This widespread vulnerability exposes sensitive patient data to 'harvest now, decrypt later' attacks, where encrypted health information stolen today could be decrypted once quantum computers become sufficiently powerful. This research highlights an urgent emerging threat as quantum computing advances accelerate and nation-state actors increasingly target healthcare infrastructure. With medical records maintaining value for decades and healthcare being the most ransomware-targeted sector, organizations face a narrow window to implement quantum-resistant encryption before cryptographically relevant quantum computers emerge.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Banking/Mortgage1 month ago

Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks

In September 2026, Ukraine's CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute LunexStealer malware through fake Cloudflare verification pages. The UAC-0277 threat cluster used ClickFix techniques and EtherHiding methods to selectively target Windows users arriving from search engines, delivering MSI packages that install sophisticated information-stealing capabilities including the LUNARAXE browser extension and NAIVEMESS file system access component. This campaign represents the growing sophistication of social engineering attacks that exploit trusted security interfaces like Cloudflare to bypass user suspicion and deliver advanced persistent threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours
Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours
Computer Software/Engineering1 month ago

Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours

In October 2026, threat actors began exploiting CVE-2026-21589, a critical arbitrary file access vulnerability in Atlassian Data Center products including Jira, Confluence, and Bitbucket. The flaw allows unauthenticated attackers to access sensitive files through path traversal manipulation, potentially exposing credentials and configuration data. Exploitation attempts began within two hours of public technical details being released, with 15 documented attacks from IP addresses in Japan and the US targeting honeypot networks. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, demonstrating how modern threat actors rapidly weaponize public proof-of-concept code to target enterprise infrastructure at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise
Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise
Government Administration1 month ago

Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise

Johnson Controls EasyIO FG industrial control systems contain critical vulnerabilities (CVE-2026-27872 and CVE-2026-27873) allowing attackers to gain full unauthorized device access through hard-coded credentials and improper privilege management. The affected firmware versions (≤2.0b52) impact building automation systems worldwide across critical infrastructure sectors including manufacturing, transportation, and energy. With CVSS scores of 7.7, successful exploitation could result in complete device compromise and operational disruption. Johnson Controls has declared the product end-of-life with no patches available, recommending migration to current-generation systems. This incident highlights the growing threat to industrial control systems and the risks posed by legacy IoT devices with embedded security flaws. As critical infrastructure becomes increasingly connected, organizations face mounting pressure to address vulnerabilities in operational technology environments that were never designed with cybersecurity in mind.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
FortiBleed Campaign Exposes Critical Gaps in Network Device Security
FortiBleed Campaign Exposes Critical Gaps in Network Device Security
Financial Services1 month ago

FortiBleed Campaign Exposes Critical Gaps in Network Device Security

The FBI and Secret Service issued warnings in October 2026 that the FortiBleed credential harvesting campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This Russian-speaking operation has successfully compromised over 86,644 device credentials across 194 countries using a sophisticated five-stage attack chain involving credential stuffing, passive traffic interception, GPU-accelerated password cracking, and lateral movement. The campaign exploits reused credentials and legacy SHA-256 password storage, with attackers creating persistent backdoor accounts and selling access to ransomware groups including INC and Lynx operators. This incident highlights the escalating threat to network perimeter devices as initial access brokers increasingly target enterprise VPN infrastructure to enable downstream ransomware operations, making credential security and multi-factor authentication critical defensive priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign
PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign
Information Technology/IT1 month ago

PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign

In 2026, cybersecurity researchers identified the Canto Incognito campaign, deploying PoeLLM malware to build a cryptocurrency mining botnet targeting AI and LLM infrastructure. Active since April 2026, the campaign infected over 3,400 servers, peaking at nearly 2,200 affected systems in mid-June. The Italian-speaking threat actors used a creative technique, hiding command-and-control addresses within poems hosted on GitHub, and targeted enterprise-facing deployments including LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances to exploit their computational power for illicit mining operations. This incident highlights the growing threat to AI infrastructure as organizations rapidly deploy LLM services without adequate security controls, making them attractive targets for cryptojacking operations due to their powerful computing resources and often inadequate monitoring.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution
Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution
Computer Software/Engineering1 month ago

Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution

A critical vulnerability (CVE-2026-105192) in LMCache, an open-source caching system for large language model servers, allows unauthenticated remote code execution with a severity score of 9.8/10. The flaw affects LMCache versions 0.3.9 through 0.5.5 in multiprocess mode, where attackers can exploit Python pickle deserialization through ZeroMQ messaging to execute arbitrary code. The vulnerability particularly impacts deployments using routable network addresses, including LMCache's own Kubernetes example configuration, with no patch currently available. This incident highlights the growing security risks in AI infrastructure as organizations rapidly adopt LLM technologies without adequate security controls. The vulnerability represents a broader trend of supply chain risks in AI frameworks, following similar ShadowMQ vulnerabilities discovered across multiple AI inference platforms in 2025.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours
Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours
Computer Software/Engineering1 month ago

Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours

On October 5th, 2024, Atlassian published patches for a critical directory traversal vulnerability (CVE-2026-21589) affecting multiple products including Jira, Confluence, and Bitbucket. The vulnerability allows attackers to read arbitrary files within the web application directory by exploiting a path traversal flaw using the pattern "::" which gets translated to "/" on the server. Within 48 hours of the Watchtowr proof-of-concept publication, SANS Internet Storm Center honeypots detected active exploitation attempts from multiple Digital Ocean IP addresses targeting the /WEB-INF/web.xml file to extract sensitive configuration data. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, with threat actors rapidly weaponizing published proof-of-concepts. The coordinated scanning activity from Digital Ocean infrastructure demonstrates how cloud platforms are increasingly leveraged for vulnerability research and exploitation campaigns targeting newly disclosed CVEs.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
Financial Services1 month ago

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Enterprise AI deployments are creating unprecedented attack surfaces that extend far beyond the AI model itself, encompassing the entire application stack including tools, data pipelines, APIs, identity systems, and cloud infrastructure. Unlike traditional applications with predictable logic, AI systems introduce probabilistic behavior and natural language processing that can be manipulated through prompt injection attacks to execute unauthorized actions across internal systems. These attacks can chain together to compromise service accounts, bypass tenant isolation, and expose sensitive data across multiple customer environments. The integration of AI into core business workflows has fundamentally altered the enterprise security landscape, requiring organizations to rethink their approach to threat modeling and security testing. Current security practices that focus solely on model safety or traditional application security miss critical vulnerabilities in the interconnected AI ecosystem, leaving organizations exposed to sophisticated attack chains that can traverse from user-facing chatbots to critical backend infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control
PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control
Information Technology/IT1 month ago

PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control

Since April 2024, the PoeLLM malware has compromised over 3,400 servers by exploiting AI services and using an innovative command-and-control mechanism hidden within a poem posted on GitHub. The threat actor, believed to be Italian-speaking, uses four specific words from the poem that map to IP addresses through a hard-coded dictionary, allowing dynamic C2 infrastructure changes without updating the malware itself. This botnet primarily focuses on cryptocurrency mining and exploit scanning while creating a network of AI-enabled proxies for potential downstream attacks. The technique demonstrates how threat actors are adapting to exploit the growing AI infrastructure landscape while using creative obfuscation methods to evade detection. The GitHub poem approach represents a new evolution in C2 resilience, as the infrastructure remains invisible to network monitoring tools unless the malware code is directly analyzed, highlighting the increasing sophistication of botnet operators.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware
FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware
Financial Services1 month ago

FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware

FortiBleed is an active credential compromise campaign targeting Fortinet firewalls and VPN gateways that has affected over 450,000 devices across 194 countries since early 2024. Attackers exploit vulnerabilities to steal credentials, create unauthorized admin accounts, and lock legitimate users out of their systems by changing passwords or disabling accounts. The FBI and Secret Service confirmed that FortiBleed serves as an initial access vector for ransomware affiliates including INC/Lynx and Payload, making standard patching and password resets insufficient for recovery. The campaign demonstrates the critical vulnerability of network perimeter devices and their role as high-value targets for initial access brokers. With VPN and firewall compromises becoming primary entry points for ransomware operations, organizations face increased pressure to implement zero-trust architectures and comprehensive credential management strategies to protect against these sophisticated supply chain attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Pwn2Own Ireland 2026 Exposes Critical Zero-Days in AI and Mobile Platforms
Pwn2Own Ireland 2026 Exposes Critical Zero-Days in AI and Mobile Platforms
Computer Software/Engineering1 month ago

Pwn2Own Ireland 2026 Exposes Critical Zero-Days in AI and Mobile Platforms

On the first day of Pwn2Own Ireland 2026, security researchers demonstrated 32 zero-day vulnerabilities across mobile devices, AI infrastructure, smart home devices, and printers, earning $388,500 in bounties. Notable exploits included multiple Samsung Galaxy S26 compromises, a seven zero-day chain against Philips Hue Bridge Pro, and successful attacks on Oracle's Autonomous AI Database and OpenAI Codex through argument injection. The competition highlighted critical security gaps in emerging AI platforms and IoT ecosystems. This incident reflects the accelerating discovery of vulnerabilities in AI-powered systems and smart devices as attack surfaces expand rapidly. With AI infrastructure becoming mission-critical and threat actors increasingly targeting these platforms, organizations must prioritize zero-trust segmentation and continuous security validation.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports