Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Oxford Nanopore 2025: MinKNOW Vulnerabilities Expose Medical Devices to Remote Exploitation
In October 2025, Oxford Nanopore Technologies disclosed three critical vulnerabilities in its MinKNOW DNA/RNA sequencing devices, impacting versions prior to 24.11. These flaws, which included missing authentication for critical functions, insufficiently protected credentials, and improper checks for exceptional conditions, allowed unauthorized users—both local and remote—to access, manipulate, or halt sequencing operations. Attackers could exploit default remote access settings and insecure credential storage to exfiltrate or alter sensitive data and cause denial of service in key sequencing workflows. The vulnerabilities were responsibly reported by academic researchers, prompting urgent advisories by CISA and the vendor. This incident underscores increasing risk to healthcare and life sciences infrastructure, with medical device supply chains emerging as a prime target for cyberattackers. As regulatory focus on medical device cybersecurity intensifies globally, organizations must swiftly address legacy systems and implement controls that secure both east-west and egress traffic, limit access, and ensure encrypted credential storage.
8 months ago
Kill Chain
CISA Warns of Active Exploitation: Motex LANSCOPE CVE-2025-61932 Added to KEV List
In October 2025, CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog after confirmation that attackers were actively exploiting an improper verification of source vulnerability in Motex LANSCOPE Endpoint Manager. This flaw enables malicious actors to bypass authentication controls or inject unauthorized communications by exploiting weak checks on communication channels. As a result, federal networks and enterprises using the affected endpoint management platform face increased risk of unauthorized access, lateral movement, and potential data compromise. The vulnerability was discovered as part of ongoing efforts to monitor critical endpoint management systems for exploitation in the wild and is considered a significant risk vector, especially for organizations reliant on enterprise management tools. The inclusion of this vulnerability in CISA’s KEV catalog underscores a broader surge in attacks targeting endpoint management platforms, reflecting the ongoing evolution of attacker techniques against core IT infrastructure. Timely patching and visibility into east-west traffic is increasingly essential, as threat actors exploit gaps before organizations can remediate newly disclosed weaknesses.
8 months ago
Kill Chain
CISA Unveils 2025 ICS Vulnerabilities: Critical Risks to Energy & Healthcare
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released eight advisories highlighting multiple critical vulnerabilities in a range of Industrial Control Systems (ICS) products, including solutions from AutomationDirect, ASKI Energy, Veeder-Root, Delta Electronics, NIHON KOHDEN, Schneider Electric, and Hitachi Energy. These vulnerabilities could allow threat actors, including both cybercriminals and nation-state adversaries, to execute remote code, escalate privileges, disrupt control functionality, or access sensitive operational data. Although no confirmed exploits were publicly detailed at the time of disclosure, the affected systems are widely deployed in energy, healthcare, and manufacturing, raising concerns about both operational integrity and national infrastructure risk. The incident underscores an urgent trend of continuous vulnerability discovery within ICS and operational technology environments as attackers increasingly target these sectors. This rising cadence of disclosures highlights both the complexity of securing interconnected systems and the need for ongoing vigilance and layered defense measures in critical infrastructure.
8 months ago
Kill Chain
Critical DoS Flaw in NIHON KOHDEN CNS-6201 Exposes Legacy Healthcare Systems
In October 2025, a critical security vulnerability (CVE-2025-59668) was disclosed in the NIHON KOHDEN Central Monitor CNS-6201—a medical device used globally in healthcare environments. The flaw, a NULL pointer dereference triggered by a specially crafted UDP packet, allows attackers to remotely cause a denial-of-service (DoS) condition, resulting in abnormal termination of the monitoring process. Exploitation requires no authentication as long as the device is network-accessible. Affected models are end-of-support, placing healthcare environments at heightened risk if legacy equipment remains unsegmented or exposed. This exposure highlights continuing challenges associated with legacy medical devices, the urgency of network segmentation, and the importance of proactive vulnerability management in healthcare. Similar technique trends surrounding unauthenticated DoS vulnerabilities in critical infrastructure increase regulatory, patient-safety, and operational risk considerations.
8 months ago
Kill Chain
Microsoft WSUS RCE Vulnerability (CVE-2025-59287) Exposes Critical Infrastructure
In October 2025, Microsoft disclosed and released an out-of-band security update for a critical remote code execution vulnerability (CVE-2025-59287) affecting Windows Server Update Services (WSUS) across multiple Windows Server versions (2012–2025). The flaw allowed unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges on unpatched WSUS servers, particularly when ports TCP 8530/8531 were exposed. Exploitation involved spawning child processes through wsusservice.exe or w3wp.exe, with threat actors leveraging PowerShell payloads and potentially broader lateral movement. Organizations failing to patch faced severe risk of compromise. This incident underscores the escalating trend of supply chain and infrastructure attacks, where core update and provisioning mechanisms are targeted to gain privileged access or disrupt operations. Active exploitation and KEV listing prompt heightened urgency for organizations to address legacy system exposures and reinforce privileged system monitoring.
8 months ago
Kill Chain
Vertikal Systems 2025: Healthcare Data at Risk via Hospital Manager Backend Vulnerabilities
In September 2025, Vertikal Systems disclosed two critical vulnerabilities affecting its Hospital Manager Backend Services. The first flaw (CVE-2025-54459) allowed unauthorized, remote access to the ASP.NET tracing endpoint, potentially exposing sensitive data such as authorization tokens and server metadata. The second (CVE-2025-61959) disclosed verbose error pages on invalid requests, inadvertently leaking application stack traces and configuration files. Both issues were exploitable without authentication, posing significant data privacy and operational risk across healthcare sites globally. This incident spotlights ongoing risks to healthcare organizations due to misconfigurations and unnecessary exposure of sensitive developer endpoints. With increasing regulatory pressure on patient data security and the healthcare sector's targeted threat profile, such vulnerabilities could lead to compliance violations or facilitate wider attacks.
8 months ago
Kill Chain
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.
8 months ago
Kill Chain
New 2025 Guidance: Securing Microsoft Exchange Servers from Infrastructure Vulnerabilities
In October 2025, cybersecurity authorities including CISA and the NSA released urgent best practices following persistent threats targeting on-premises Microsoft Exchange servers. Despite patch releases and increased awareness, many organizations continued running outdated or misconfigured Exchange environments, leaving them vulnerable to exploitation. Attackers leveraged these weaknesses to gain unauthorized access, often leading to lateral movement, data exfiltration, and in some cases, ransomware incidents. The culmination of such ongoing attacks prompted renewed guidance emphasizing strong authentication, rigorous encryption, and decommissioning of unsupported hybrid Exchange servers to minimize operational risk. This incident underscores the ongoing trend of adversaries exploiting infrastructure vulnerabilities, especially in legacy and hybrid setups. With continued attacker innovation and regulatory scrutiny, organizations must adopt zero trust principles, prioritize patch cycles, and upgrade legacy systems to mitigate evolving threats.
8 months ago
Kill Chain
CISA Highlights Active Exploitation of XWiki & VMware Vulnerabilities in 2025 KEV Catalog Update
In October 2025, CISA added two actively exploited vulnerabilities—CVE-2025-24893 in XWiki Platform (Eval Injection) and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools (Privilege Defined with Unsafe Actions)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws enable remote attackers to inject malicious code or escalate privileges, presenting substantial risks for the federal enterprise and beyond. The inclusion in the KEV Catalog signals confirmed in-the-wild exploitation and compels agencies to expedite remediation measures under Binding Operational Directive 22-01 to protect critical federal infrastructure networks. This incident underscores the persistent trend of attackers rapidly leveraging new or previously overlooked vulnerabilities with real-world consequences. As the speed of exploitation shortens and attack surfaces broaden, timely vulnerability management, zero trust practices, and proactive monitoring remain vital to reducing enterprise cyber risk.
8 months ago
Kill Chain
PhantomRaven’s Malicious npm Packages: 2024 Supply-Chain Risk with Invisible Dependencies
In early 2024, the "PhantomRaven" campaign targeted the open-source software ecosystem by distributing 126 malicious npm packages containing concealed, 'invisible' dependencies. These packages, published over several months, bypassed detection mechanisms and were downloaded over 86,000 times by unsuspecting developers. Threat actors leveraged these supply chain attacks to potentially exfiltrate sensitive data, propagate malware, or serve as initial entry points for deeper compromises in downstream applications and organizations dependent on these packages. The campaign highlighted significant vulnerabilities in supply-chain security and the risks associated with open-source package management. This incident is part of a rising trend of sophisticated supply-chain attacks leveraging trusted developer tools and repositories. With increasing regulatory scrutiny and mounting pressure to harden software dependencies, organizations must assess their exposure and implement robust controls to thwart similar attacks in the future.
8 months ago
Kill Chain
PhantomRaven Floods npm with Malicious Credential-Stealing Packages
In April 2024, the 'PhantomRaven' threat campaign targeted the JavaScript software ecosystem by flooding the npm package repository with dozens of malicious packages. These packages, aimed at developers and CI/CD environments, were crafted to harvest authentication tokens, CI/CD secrets, and GitHub credentials when installed. Attackers employed typosquatting and deceptive package naming techniques to trick developers into integrating the compromised code into their applications, thereby enabling broad access to source code and sensitive internal systems. The attack underscores the growing risk posed by software supply chain compromises, impacting thousands of potential downstream applications and organizations. This incident highlights an ongoing surge in supply chain attacks leveraging public code repositories, targeting both individual developers and enterprise development pipelines. Attackers are increasingly employing credential harvesting via trusted open-source channels, intensifying regulatory scrutiny and driving immediate needs for enhanced software integrity controls and threat detection across development workflows.
8 months ago
Kill Chain
Microsoft 2024 DNS Outage Paralyzes Azure & Microsoft 365 Globally
On June 20, 2024, Microsoft experienced a global DNS outage that disrupted access to Azure and Microsoft 365 services for customers worldwide. The outage was triggered by an internal DNS configuration issue that affected service resolution and authentication to corporate networks. Users reported being unable to access several core Microsoft services, including email, cloud storage, and collaboration tools. Microsoft’s engineering teams identified the root cause and began remediation, but the incident resulted in widespread operational downtime lasting several hours and affected businesses dependent on Microsoft’s cloud infrastructure. This incident highlights the increasing business impact of cloud infrastructure dependencies and emphasizes the importance of resilient and redundant DNS architectures. Service disruptions of this magnitude reinforce regulatory and customer scrutiny regarding cloud service reliability and prompt renewed attention to business continuity, availability controls, and third-party risk management.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports