Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 211 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2521–2532 / 3497 reports
2026 n8n Remote Code Execution Exposes Supply-Chain Security Gaps
Information Technology/IT9 months ago

2026 n8n Remote Code Execution Exposes Supply-Chain Security Gaps

In January 2026, a critical supply-chain vulnerability (CVE-2026-21858, CVSS 10.0) was disclosed in n8n, a widely used open-source workflow automation tool. This unauthenticated remote code execution flaw enables attackers to fully compromise vulnerable self-hosted instances, potentially taking control of exposed servers across an estimated 100,000 global installations. The vulnerability is present in n8n versions between 1.65.0 and 1.120.4. No official mitigations or workarounds exist; remediation requires upgrading to version 1.121.0 or later. Attackers exploiting this bug could gain persistent access, manipulate workflows, or use impacted servers for further lateral movement and supply-chain attacks. This incident highlights a growing trend of attackers targeting automation and orchestration platforms as initial entry points. The rapid exploitation window, lack of mitigations, and broad exposure emphasize the urgent need for organizations to prioritize patching and review their supply-chain and workflow application security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Monroe University 2024 Breach: 320,000 Impacted by Massive Data Exposure
Higher Education/Acadamia9 months ago

Monroe University 2024 Breach: 320,000 Impacted by Massive Data Exposure

In December 2024, Monroe University suffered a significant data breach during which threat actors gained unauthorized access to the institution's network for two weeks, from December 9 to December 23. Attackers exfiltrated sensitive personal, financial, and health information belonging to over 320,000 individuals—including faculty, students, and affiliates—after penetrating university systems. The breach, discovered after a review of stolen files in September 2025, exposed details such as names, Social Security numbers, medical and health insurance information, government IDs, and financial credentials, prompting the university to notify affected individuals and offer credit monitoring services. This incident underscores the persistent challenges higher education institutions face in defending against data theft, especially as ransomware and targeted attacks exploit legacy systems and limited segmentation. With higher ed continuing to be a lucrative target and similar breaches on the rise, Monroe’s experience highlights the critical need for enhanced east-west security, proactive monitoring, and compliance controls to protect sensitive student and institutional data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Reprompt Attack: How Microsoft Copilot’s 2026 AI Vulnerability Enabled Silent Data Exfiltration
Computer Software/Engineering9 months ago

Reprompt Attack: How Microsoft Copilot’s 2026 AI Vulnerability Enabled Silent Data Exfiltration

In January 2026, security researchers disclosed a critical vulnerability—termed the 'Reprompt' attack—in Microsoft Copilot Personal, enabling attackers to hijack user sessions and exfiltrate sensitive data through malicious prompt injection. By embedding harmful prompts in the 'q' URL parameter and leveraging Copilot's automatic execution, attackers could persistently access authenticated sessions and orchestrate stealthy data theft without user awareness. Microsoft Copilot, deeply integrated in Windows and Edge, was susceptible due to its handling of context and prompt flows; the attack chain was demonstrated by Varonis Security, who responsibly disclosed the flaw to Microsoft, leading to a patch release on January 2026's Patch Tuesday. Fortunately, there was no evidence of exploitation in the wild, and enterprise-targeted Copilot versions were unaffected due to stronger controls. This incident highlights the growing risk landscape as AI assistants and LLMs gain deeper access to personal and enterprise data. The Reprompt exploitation showcases the evolution of prompt injection from theoretical risk to practical attack, underlining the urgency for robust guardrails, user security awareness, and compliance-ready AI deployments as generative AI tools proliferate.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How ConsentFix OAuth Phishing Redefined Microsoft Cloud Account Threats in 2024
Financial Services9 months ago

How ConsentFix OAuth Phishing Redefined Microsoft Cloud Account Threats in 2024

In early 2024, security researchers uncovered 'ConsentFix,' a sophisticated OAuth phishing campaign targeting Microsoft account holders across multiple sectors. Attackers leveraged consent phishing techniques, using malicious OAuth applications and browser-based authorization flows to trick users into granting access to their Microsoft 365 data—bypassing traditional credential-based defenses. Victims, believing they were authorizing legitimate apps, inadvertently permitted attackers to persistently access mail, files, and other sensitive resources. The campaign quickly evolved, with new variants adopting evasive tactics and leveraging cloud application trust models. Consent phishing's rise highlights a worrying trend: attackers increasingly exploit identity platforms and legitimate authorization mechanisms, rather than relying on malware or password theft. As organizations accelerate cloud adoption and remote collaboration, monitoring and mitigating application consent attacks is paramount for regulatory compliance and security posture.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Victorian Department of Education Student Data Breach: Supply Chain Risk in Focus
Primary/Secondary Education9 months ago

Victorian Department of Education Student Data Breach: Supply Chain Risk in Focus

In early June 2024, the Victorian Department of Education in Australia disclosed a major data breach impacting thousands of current and former students. Attackers exploited a third-party file transfer platform, gaining unauthorized access to sensitive personal information, including names, addresses, dates of birth, and potentially other contact and identification details. The breach prompted direct notifications to affected families and led to an immediate investigation in collaboration with cybersecurity partners and law enforcement. The department took affected systems offline, bolstered security controls, and assessed the scale of data compromise. This incident comes amid a global surge in attacks exploiting third-party platforms and supply chain vendors, as seen in recent mass hacks targeting educational and government sectors. It underlines the urgent need for robust data segmentation, encrypted traffic, and continuous anomaly detection to protect critical personal information from increasingly sophisticated threat actors.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
SHADOW#REACTOR: 2026’s Multi-Layered Remcos RAT Attack on Windows Systems
Financial Services9 months ago

SHADOW#REACTOR: 2026’s Multi-Layered Remcos RAT Attack on Windows Systems

In January 2026, cybersecurity researchers uncovered an evasive malware campaign dubbed SHADOW#REACTOR that delivered Remcos RAT via a sophisticated, multi-stage Windows attack chain. Attackers used obfuscated VBS scripts initiated through user interaction to invoke PowerShell downloaders that fetched fragmented text-based payloads. These were assembled and decrypted in memory using .NET Reactor–protected loaders, eventually launching the Remcos RAT through MSBuild.exe to gain covert, persistent access. The campaign primarily targeted enterprises and SMBs, leveraging modular loaders and living-off-the-land binaries for stealth, resilience, and evasiveness, with a clear design to complicate detection and incident response. The campaign’s blending of text-only stagers, in-memory decoding, and LOLBin abuse demonstrates the ongoing evolution of malware delivery tactics. It highlights the rising sophistication of opportunistic attackers serving as initial access brokers, reflecting a broader trend toward modular, easily adaptable attack frameworks that challenge defensive controls in both enterprise and midmarket environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical FortiSIEM Command Injection Exploit Puts Enterprises at Risk in 2024
Financial Services9 months ago

Critical FortiSIEM Command Injection Exploit Puts Enterprises at Risk in 2024

In June 2024, a critical remote code execution (RCE) vulnerability was publicly disclosed for Fortinet's FortiSIEM solution (CVE-2024-23108/CVE-2024-23109). Public exploit code was released, enabling remote, unauthenticated attackers to execute arbitrary commands on affected systems. The flaw, rated CVSS 10.0, exposes organizations using FortiSIEM to the risk of full system compromise and data exfiltration, with security teams scrambling to identify exposure and deploy patches. Fortinet has released urgent security updates, while threat intelligence sources report active scanning and attempted exploitation in the wild within days of disclosure. This incident underscores an accelerating trend of attackers exploiting zero-day or n-day flaws rapidly after public disclosure, often leveraging weaponized PoCs released on open-source platforms. Enterprises with lagging patch cycles or poor internal segmentation remain at heightened risk amid regulatory scrutiny and increased lateral movement by threat actors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ServiceNow Patches Critical AI Platform Vulnerability Exposing Unauthenticated User Impersonation Risk
Information Technology/IT9 months ago

ServiceNow Patches Critical AI Platform Vulnerability Exposing Unauthenticated User Impersonation Risk

In January 2025, ServiceNow disclosed a critical security vulnerability (CVE-2025-12420, dubbed 'BodySnatcher') in its AI Platform allowing unauthenticated attackers to impersonate legitimate users and perform arbitrary actions with their privileges. The flaw, which received a CVSS score of 9.3, provided a simple attack vector for adversaries to exploit publicly accessible ServiceNow environments, potentially leading to widespread data exposure, privilege escalation, and compromise of sensitive workflows. No authentication was required to leverage this bug, amplifying its risk across enterprises leveraging ServiceNow AI for automation and service management. This breach highlights the increasing dangers posed by identity-based exploits in cloud SaaS applications, especially as organizations accelerate AI and automation initiatives. Attacker interest in identity manipulation has surged, putting pressure on SaaS security postures and regulatory compliance, making timely patching and identity-centric controls non-negotiable.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
China-Linked VoidLink Malware Hits Linux Cloud and Container Workloads
Information Technology/IT9 months ago

China-Linked VoidLink Malware Hits Linux Cloud and Container Workloads

In December 2025, security researchers identified a sophisticated, modular malware framework called VoidLink, engineered by a China-linked APT group to target Linux-based cloud and container environments. This threat leverages advanced rootkit features, credential harvesting, anti-forensics modules, and a modular plugin system to maintain long-term, stealthy access. The malware natively detects and adapts to Docker, Kubernetes, and major cloud service providers such as AWS, Azure, GCP, Alibaba, and Tencent, with its operators able to control it remotely via a web-based dashboard. VoidLink is believed to be used for espionage, data exfiltration, and potentially supply chain attacks affecting software developers and cloud-native infrastructure. VoidLink exemplifies a rapidly growing threat to cloud and DevOps ecosystems, where attackers increasingly favor Linux malware frameworks capable of evading modern detection. Organizations should note the malware’s cloud awareness, lateral movement abilities, and automated risk-adaptive evasions as they re-evaluate Linux and cloud security controls amidst a surge in advanced APT targeting of critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
How CVE-2025-6514 Unleashed AI Agents: The 2026 MCP Security Crisis
Computer Software/Engineering9 months ago

How CVE-2025-6514 Unleashed AI Agents: The 2026 MCP Security Crisis

In January 2026, a critical security incident exposed systemic risks in agentic AI environments after threat actors exploited CVE-2025-6514—a vulnerability in a widely used OAuth proxy underpinning Machine Control Protocols (MCPs). By leveraging misconfigured or compromised MCP servers, attackers gained remote code execution across automation pipelines affecting over 500,000 developer environments and AI-driven workflows. The breach enabled malicious actors to execute unauthorized actions, abuse privileged APIs, and proliferate shadow API keys, resulting in substantial risks to source code integrity, business operations, and broader cloud infrastructures. This incident highlights the evolving threat landscape of autonomous AI agents and demonstrates how traditional identity models fail when automation drives execution at scale. The proliferation of agentic AI, coupled with insufficient visibility and control over MCP interactions, calls for urgent adoption of new governance frameworks, detection measures, and AI-specific access controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Node.js async_hooks Vulnerability Puts Production Apps at Risk of DoS Attacks
Information Technology/IT9 months ago

Critical Node.js async_hooks Vulnerability Puts Production Apps at Risk of DoS Attacks

In January 2026, Node.js disclosed a critical vulnerability (CVE-2025-59466) affecting all production environments using the async_hooks module, which underpins popular frameworks and monitoring tools such as React Server Components, Next.js, and major APM platforms. The flaw allowed an attacker to cause a denial-of-service (DoS) condition by forcing stack space exhaustion via unsanitized user input, leading the Node.js process to crash unexpectedly without a catchable error. All supported Node.js Long Term Support (LTS) versions were patched, while older, unsupported releases remain exposed, impacting a broad portion of the JavaScript ecosystem. This incident highlights not only the risks inherent in reliance on low-level APIs, but also the speed at which vulnerabilities impacting critical supply chain components can disrupt software availability. Organizations reliant on Node.js for cloud, SaaS, and modern web solutions face renewed pressure to update dependencies proactively and establish robust exception handling and segmentation practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
2026 Web Research: Unjustified Third-Party App Data Access Exposes Massive Risk
Government Administration9 months ago

2026 Web Research: Unjustified Third-Party App Data Access Exposes Massive Risk

In January 2026, new research exposed that 64% of third-party applications integrated by over 4,700 prominent websites were accessing sensitive user and business data without valid justification. The study found alarming trends, notably a surge in malicious activity targeting the government sector (rising from 2% to 12.9%) and a concerning rate of active compromise in education sites, with one in seven showing evidence of ongoing breaches. Key offenders included Google Tag Manager, Shopify, and Facebook Pixel, which collectively accounted for a significant proportion of data exposure violations. The study reveals ongoing systemic weaknesses in the vetting and oversight of embedded web applications, risking confidential data and regulatory non-compliance for organizations. This report is especially pertinent amidst increased regulatory scrutiny and as supply chain attacks become more prevalent. Attackers are exploiting trust relationships with third-party services, while organizations face rising pressure to demonstrate rigorous controls over data sharing and vendor integrations. The findings underscore a shift in attacker focus and highlight the operational risks of unchecked third-party access.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports