Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
8 months ago
Kill Chain
WordPress Plugin Flaw Exposes Sensitive Data to Subscribers in 2024
In June 2024, a critical vulnerability was disclosed in the widely used WordPress 'Anti-Malware Security and Brute-Force Firewall' plugin, which is active on over 100,000 websites. The flaw enables authenticated subscriber-level users to exploit improperly validated file access mechanisms, granting them read access to arbitrary files stored on the web server. This could allow the exposure of sensitive configuration files, credentials, or proprietary business data, significantly undermining site security and user privacy. Plugin maintainers were alerted, and a patched version was released to mitigate the issue. This incident emphasizes the risks posed by third-party plugin vulnerabilities within content management platforms, which remain a persistent attack vector as organizations contend with rapid plugin adoption and reliance on open-source tools.
8 months ago
Kill Chain
10 Malicious npm Packages Expose Global Supply Chain Risks in 2025 Credential Stealer Attack
In October 2025, security researchers uncovered a coordinated supply chain attack targeting the npm ecosystem. Ten malicious npm packages, collectively downloaded over 5,000 times, were found to contain sophisticated multi-platform information stealers. These packages, distributed via the npm registry and impersonating legitimate developer tools, leveraged obfuscated code to deploy a payload capable of extracting sensitive credentials and environment data from Windows, macOS, and Linux developer workstations. The malware used deceptive tactics like a fake CAPTCHA screen and fingerprinted victims prior to exfiltrating stolen data to attacker-controlled infrastructure. This incident underscores the growing trend of software supply chain attacks, as developer tool ecosystems like npm remain high-value targets for both financially motivated cybercriminals and state-sponsored groups. The event has fueled concerns about package registry hygiene, developer workstation security, and the need for stronger zero trust and anomaly detection controls across the software development lifecycle.
8 months ago
Kill Chain
Identity Chaos: 2026 Breach Highlights Risks of Ghost Accounts & AI Agents
In mid-2026, a coordinated cyberattack leveraged unmanaged 'ghost' identities and dormant privileged accounts in a multinational enterprise's cloud environment. Advanced threat actors combined long-standing identity debt from old breaches with modern, AI-powered autonomous agents to hijack internal east-west traffic and exfiltrate sensitive data using encrypted channels. The attackers discreetly escalated privileges through unused accounts, bypassed segmentation controls, and evaded legacy monitoring through encrypted, high-speed service-to-service traffic. This led to a multi-week data theft and operational disruption across cloud, on-premises, and hybrid infrastructure, impacting customer trust and critical regulatory compliance. This incident highlights the urgent need for advanced identity governance and zero trust segmentation as adversaries exploit both inherited identity risks and cutting-edge automation. With ransomware and shadow AI toolchains on the rise, organizations face increasing regulatory scrutiny and evolving attack surfaces that obsolete traditional perimeter-based defenses.
8 months ago
Kill Chain
Cloaking Attack Against AI Crawlers Uncovers New Context Poisoning Risks
In October 2025, cybersecurity researchers uncovered a sophisticated cloaking attack that targets AI-driven web crawlers used by popular agentic browsers such as OpenAI ChatGPT Atlas and Perplexity. Threat actors deployed malicious websites capable of serving misleading or false content only to AIbots, while displaying legitimate information to typical users. This context poisoning technique allows harmful actors to manipulate AI models at scale, tricking them into citing fabricated facts as verified information, and undermines AI trustworthiness with widespread downstream effects on automated decision-making and knowledge dissemination. This incident highlights the mounting risks from adversarial attacks targeting AI supply chains. As AI systems increasingly rely on real-time internet data, attackers are innovating new manipulation tactics to poison context and subvert trust. The surge in such TTPs coincides with tighter regulations and industry push towards Responsible AI frameworks.
8 months ago
Kill Chain
Automated Botnet Attacks Surge Against PHP Servers and IoT Devices in 2025
In October 2025, cybersecurity experts reported a significant escalation in automated botnet attacks against PHP servers and IoT devices. Threat actors behind botnets like Mirai, Gafgyt, and Mozi orchestrated large-scale campaigns by exploiting known CVEs and exploiting misconfigured cloud and edge systems. The attacks enabled adversaries to gain unauthorized entry, rapidly compromise vulnerable assets, and expand their botnet infrastructure for malicious activities such as DDoS, credential theft, and lateral movement across network environments. Organizations with exposed PHP servers or poorly secured IoT endpoints experienced elevated risks of disruption and reputational impact. This surge in automated exploitation highlights the persistent evolution of botnet tactics targeting unpatched, internet-facing workloads. As attackers automate vulnerability scanning and weaponize scalable malware, the need for proactive threat detection, segmentation, and rapid response has never been more critical for organizations in all sectors.
8 months ago
Kill Chain
What 1,000 Insider Threat Cases Reveal: A Modern Security Wake-Up Call
In 2024, a comprehensive study examining over 1,000 real-world insider threat cases uncovered persistent gaps in how organizations detect, prevent, and respond to malicious or negligent employee actions. Over a 14-month analysis, security researchers highlighted that insiders often bypass security controls using legitimate access, evade traditional perimeter monitoring tools, and exfiltrate sensitive data without raising timely alerts. The analysis found that costly business disruptions, regulatory fines, and reputational damages were common outcomes, especially in sectors with high data sensitivity, including finance, healthcare, and technology. The research underscores growing sophistication among insiders and the limitations of legacy detection models. Insider threats remain acute as remote work widens the digital attack surface and increasingly sophisticated insiders exploit blind spots in technical controls. Regulatory bodies are pressuring organizations to enhance controls and real-time monitoring, highlighting that traditional security models are insufficient as threat actor tactics evolve.
8 months ago
Kill Chain
F5's 2024 Nation-State Breach: Lessons in Supply Chain and Platform Security
In late 2023, F5 Networks experienced a prolonged attack attributed to a nation-state threat actor who gained persistent access to internal systems, stealing segments of BIG-IP source code, undisclosed vulnerabilities, and customer configuration data. The company became aware of the intrusion on August 9, with public disclosure on October 15 following a rare emergency directive from federal authorities. F5 coordinated with security firms and mobilized rapid emergency software and hardware updates across thousands of customer deployments while investigating the breach’s full scope. The identified impact included widespread emergency patching and a limited set of customers affected by stolen configuration data, though F5 reported that most exfiltrated information was not sensitive. This incident underscores ongoing targeting of technology and security vendors by advanced persistent threat actors. With the steady increase in supply chain attacks, the F5 breach highlights the need for stronger product code security, rapid response to vulnerability disclosure, and cross-industry collaboration against sophisticated intrusions.
8 months ago
Kill Chain
Signal Raises the Bar: Post-Quantum Cryptography Enhances Messaging Security in 2025
In October 2025, Signal deployed a groundbreaking update to its secure messaging protocol, introducing a post-quantum cryptographic architecture known as the Sparse Post Quantum Ratchet (SPQR). Developed in collaboration with PQShield, AIST, and NYU, this implementation combines classical elliptic-curve cryptography with a new quantum-resistant Key Encapsulation Mechanism (KEM). The protocol uses both the classical Double Ratchet and the new KEM-based ratchet in parallel, mixing their outputs to derive message encryption keys. This hybrid approach ensures that even if one cryptographic system is compromised—by quantum or conventional means—messages remain protected by the other system, significantly enhancing Signal’s defense against future quantum-enabled attacks. Signal’s quantum-safe upgrade sets a precedent as quantum and post-quantum threats become increasingly realistic, with other messaging and critical infrastructure providers closely monitoring and evaluating similar migration paths. The move signals a wider trend toward proactive cryptographic agility and future-proofing, in line with regulatory and industry pressures to stay ahead of emerging attack vectors.
8 months ago
Kill Chain
Herodotus Android Malware: Sophisticated Human-Like Typing Evasion Uncovered in 2024
In early June 2024, cybersecurity researchers identified a new Android malware family, Herodotus, which leverages advanced evasion tactics to bypass mobile security defenses. Disguised as legitimate applications, Herodotus executes random delay injection within its input routines to emulate human-like typing behaviors. This innovative technique thwarts traditional detection mechanisms that rely on recognizing predictable or automated input patterns, thereby enabling the malware to steal credentials, access sensitive data, and potentially gain persistence on compromised Android devices. The threat actors exploit users who install trojanized apps from unofficial sources, broadening their infection base and weakening mobile ecosystem defenses. The Herodotus incident highlights the escalating sophistication of mobile malware and the urgent need for organizations and consumers to implement robust mobile endpoint security controls. Its emergence coincides with a marked increase in malware adopting anti-detection tactics, signaling a concerning trend in attacker adaptation and the ongoing cat-and-mouse dynamic in mobile cybersecurity.
8 months ago
Kill Chain
Atroposia Malware-as-a-Service Threatens 2024 Cybersecurity with Automated Vulnerability Scanning
In early June 2024, the cybersecurity community confirmed the emergence of Atroposia, a sophisticated Malware-as-a-Service (MaaS) platform offering attackers a feature-rich remote access trojan (RAT). Atroposia distinguishes itself from conventional malware by fusing persistent access, stealthy evasion, credential theft, and automated local vulnerability scanning within a single toolkit. Threat actors leveraging Atroposia can gain initial footholds via phishing or malware campaigns, then use the built-in scanner to enumerate unpatched vulnerabilities in compromised environments, accelerating lateral movement and privilege escalation while remaining elusive to defenses. The rapid adoption of Atroposia by criminal actors raises the risk of automated exploitation and more deeply entrenched incidents across industries. This incident is notable for the shift toward criminal malware platforms bundled with security assessment features, lowering the barrier for less-skilled attackers to conduct advanced operations. Security teams must address these evolving threats with layered defenses and continuous vulnerability management as attacker agility outpaces legacy controls.
8 months ago
Kill Chain
TEE.Fail Side-Channel Attack Exposes Flaws in Confidential Computing Across Intel, AMD, and NVIDIA CPUs
In early 2024, researchers uncovered a novel hardware vulnerability named TEE.Fail, capable of extracting cryptographic secrets from the trusted execution environments (TEEs) of major CPUs, including Intel SGX/TDX, AMD SEV-SNP, and NVIDIA H100. Exploiting side-channel flaws in the hardware design, attackers could bypass the isolated security boundary provided by TEEs, accessing sensitive data once thought to be well-protected. No evidence of attacks in the wild has surfaced, but proof-of-concept exploitation demonstrates wide-ranging risk for cloud providers and enterprises relying on confidential computing for regulatory compliance and sensitive workloads. The TEE.Fail disclosure highlights a growing trend of advanced research targeting the hardware roots of modern security. As organizations adopt confidential computing to strengthen privacy and regulatory posture, attackers may increasingly seek to exploit hardware and microarchitecture flaws beyond conventional software vulnerabilities.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports