Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 223 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2665–2676 / 3497 reports
Clop Ransomware Hits Gladinet CentreStack: 2025 Data Theft Alert
Financial Services10 months ago

Clop Ransomware Hits Gladinet CentreStack: 2025 Data Theft Alert

In December 2025, the Clop ransomware gang initiated a widespread extortion campaign by exploiting internet-facing Gladinet CentreStack file servers. Gladinet CentreStack, used by thousands of businesses worldwide, enables remote file sharing without VPNs. The attackers scanned for accessible servers, exploited a yet-undetermined (potentially zero-day or unpatched) vulnerability, and exfiltrated sensitive business data, leaving ransom notes for victims. The breaches escalated concerns after Clop’s history with major file transfer solutions, such as MOVEit and Oracle EBS, resulting in significant data leaks and operational disruption for affected organizations. This attack underscores the persistent risk posed by sophisticated ransomware groups exploiting file transfer and sharing platforms. With attackers rapidly leveraging unknown or unpatched security flaws, enterprises must prioritize robust vulnerability management for all internet-exposed assets and monitor threat actor trends targeting remote-access file servers.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
HPE OneView 2025: CVE-2025-37164 Remote Code Execution Threat
Information Technology/IT10 months ago

HPE OneView 2025: CVE-2025-37164 Remote Code Execution Threat

In June 2025, Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164) in its OneView infrastructure management software, allowing unauthenticated remote code execution via network exposure. Rated CVSS 10.0, the flaw enabled threat actors to gain full control over affected systems by exploiting improper input validation in OneView’s remote management interfaces. This vulnerability posed immediate risk to critical infrastructure across industries relying on OneView for centralized management, potentially resulting in disruption, unauthorized access, or lateral movement within enterprise environments. The discovery highlights ongoing concerns around enterprise software supply chain security and the elevated threats facing privileged IT management tools. Increasingly, sophisticated threat actors target such infrastructure software to bypass traditional security controls, emphasizing the urgency for timely patching and advanced east-west traffic controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
2025 Multi-Vector Breach: WhatsApp Hijacks, MCP Leaks & AI Threats Signal New Era of Cyber Attacks
Financial Services10 months ago

2025 Multi-Vector Breach: WhatsApp Hijacks, MCP Leaks & AI Threats Signal New Era of Cyber Attacks

In December 2025, adversaries leveraged multiple cyberattack vectors—including WhatsApp account hijacking, major control plane (MCP) data leaks, generative AI reconnaissance, and the React2Shell exploit—to target organizations worldwide. Attackers combined social engineering, exploitation of unpatched vulnerabilities, and east-west traffic movement for lateral compromise. The orchestration of these tactics led to large-scale credential theft, successful ransomware deployment, and significant data exfiltration across cloud and on-premise environments. Notably, sophisticated evasion and automation tools hindered early detection and response, increasing operational disruption and risk exposure for affected enterprises. This incident exemplifies how weaponized AI, hybrid cloud vulnerabilities, and multi-vector attacks are converging. Organizations face growing urgency for zero trust segmentation, improved encrypted traffic controls, and comprehensive threat detection as attackers exploit interconnected infrastructure weaknesses and automation gaps.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Sha1-Hulud 2025: The Multi-Vector Threat Campaign that Redefined Cloud Security
Financial Services10 months ago

Sha1-Hulud 2025: The Multi-Vector Threat Campaign that Redefined Cloud Security

In December 2025, security researchers observed a sophisticated multi-vector attack campaign, dubbed 'Sha1-Hulud,' targeting organizations across North America, Europe, and Asia. The campaign leveraged vulnerabilities in remote management tools such as ScreenConnect and MacSync to gain initial access, then proceeded laterally using encrypted traffic, zero trust segmentation evasion, and cloud-native pivoting. Attackers deployed covert remote access tools and exploited gaps in cloud firewall and egress controls to move data out, leaving organizations grappling with data theft, systems downtime, and regulatory exposure. This incident is notable for its integration of advanced encryption bypass, multicloud movement, and the blending of traditional and cloud-native evasion tactics. The convergence of infrastructure and cloud threats highlights the need for ubiquitous visibility, modern segmentation, and coordinated policy enforcement in response to increasingly diverse and distributed attacks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
React2Shell 2025: When AI-Generated Exploits Complicate Supply Chain Defense
Computer Software/Engineering10 months ago

React2Shell 2025: When AI-Generated Exploits Complicate Supply Chain Defense

In December 2025, the cybersecurity community was rocked by mass exploitation efforts targeting "React2Shell," a critical vulnerability in the popular React UI framework. Threat actors, including China-linked groups, quickly launched attacks just hours after the initial public advisory. Amid the chaos, researchers and automated AI tools published over a hundred proof-of-concept (PoC) exploits—many of which were either nonfunctional or misrepresented the true risk, leading to widespread confusion. This "AI slop" polluted vulnerability feeds and caused defenders to waste valuable time, potentially resulting in underestimating the urgency to patch real flaws. The incident exposed significant weaknesses in open-source supply chain security, the peer-review process for public PoCs, and how security teams triage emerging threats. The React2Shell event is emblematic of the growing challenges defenders face as AI-generated code and public exploit sharing accelerate the pace and volume of security noise. With enterprises relying on automated detection and research, this incident highlights systemic risks posed by false negatives, delayed remediation, and rushed patch management in the face of incomplete or misleading information.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cellik RAT’s Google Play Store Infiltration Exposes Mobile Security Gaps
Banking/Mortgage10 months ago

Cellik RAT’s Google Play Store Infiltration Exposes Mobile Security Gaps

In June 2024, cybersecurity researchers uncovered that the Cellik Android Remote Access Trojan (RAT) was being distributed through malicious applications on the official Google Play Store. The Cellik RAT allows attackers to remotely control infected Android devices, harvest sensitive credentials, and exfiltrate private data without the user’s knowledge. Threat actors used advanced evasion tactics, including app generation within Play Store guidelines and encrypted communications, to bypass traditional defenses. The incident highlights weaknesses in mobile app review processes and demonstrates the continued use of popular app stores as distribution vectors for sophisticated malware campaigns. This breach is especially notable as attackers continue to exploit trusted platforms like the Google Play Store, elevating risk for both individuals and enterprises. The emergence of Cellik marks an uptick in mobile RAT sophistication and underscores the urgent need for stronger app vetting and threat detection on mainstream digital ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical Fortinet Flaws: Active Attacks Compromise Admin Accounts & Configs
Financial Services10 months ago

Critical Fortinet Flaws: Active Attacks Compromise Admin Accounts & Configs

In May 2024, threat actors began actively exploiting multiple critical vulnerabilities in Fortinet network devices, specifically targeting admin accounts to gain unauthorized access. Once authenticated, attackers exported sensitive device configurations containing hashed credentials and other proprietary information. The exploit allows lateral movement and increases the risk of sensitive enterprise data exposure, with widespread impacts noted across sectors relying on network infrastructure security. Fortinet urged immediate mitigation after observing attacks in the wild, with rapid patch releases and threat intelligence sharing. This incident highlights a concerning trend of attackers leveraging zero-day or freshly-disclosed vulnerabilities in widely deployed network appliances. As targeting of privileged accounts and network infrastructure rises, organizations must enhance monitoring, patch management, and segmentation strategies to prevent systemic compromise.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
React2Shell: How Diverse Exploit Techniques Targeted React Server Components in 2023
Computer Software/Engineering10 months ago

React2Shell: How Diverse Exploit Techniques Targeted React Server Components in 2023

In December 2023, ongoing exploit attempts targeting React Server Components were observed, with attackers leveraging a variant known as 'React2Shell.' The threat actors sent crafted HTTP POST requests containing custom headers and malicious payloads exploiting web application vulnerabilities to execute arbitrary shell commands on compromised systems. Attackers expanded their reach by diversifying target endpoints (e.g., /, /api, /app) as previously vulnerable systems dwindled. The payloads enabled remote code execution, posing a risk of full system compromise and lateral movement across victim networks. The direct business impact includes potential data breach, operational disruptions, compliance failures, and reputational harm for affected organizations. This incident highlights evolving web application exploitation tactics, including the constant adaptation of attackers as defenses improve. The surge in diverse exploit attempts against publicly exposed development components like React reflects broader trends in both sophistication and frequency of web-based threats, stressing the imperative for proactive threat detection and rapid patch management.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft 2025 MSMQ and IIS Outage: A Cautionary Tale of Security Permissions Gone Wrong
Financial Services10 months ago

Microsoft 2025 MSMQ and IIS Outage: A Cautionary Tale of Security Permissions Gone Wrong

In December 2025, Microsoft enterprise customers experienced widespread outages in applications and IIS web services following the deployment of Patch Tuesday updates (KB5071546, KB5071544, KB5071543). These updates introduced changes to the Message Queuing (MSMQ) security model, restricting NTFS permissions on the C:\Windows\System32\MSMQ\storage folder. As a result, non-administrator MSMQ users lost write access, causing MSMQ to fail and IIS sites to return misleading 'insufficient resources' errors. This affected core business processes dependent on MSMQ, with no immediate fix available; Microsoft urged affected organizations to reach out for mitigation guidance. This incident highlights ongoing risks from software supply chain updates and privileged permission management changes at the operating system level. As cloud workloads and zero-trust architectures become more prevalent, enterprises must strengthen configuration management and anomaly response to avoid business disruption from untested or misconfigured OS-level security changes.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
DOJ Takes Down E-Note: Ransomware Laundering Hub Disrupted in 2024 Crackdown
Financial Services10 months ago

DOJ Takes Down E-Note: Ransomware Laundering Hub Disrupted in 2024 Crackdown

In early 2024, the US Department of Justice, in partnership with international law enforcement, dismantled the E-Note cryptocurrency exchange—a major online infrastructure used for laundering illicit proceeds from ransomware and cybercrime. Authorities indicted Mykhalio Petrovich Chudnovets, a Russian national alleged to have operated E-Note since 2010, with facilitating the transfer of over $70 million in stolen or extorted funds from attacks targeting sectors like healthcare and critical infrastructure. Federal and state agencies seized E-Note servers, websites, and mobile apps, obtaining customer and transaction data to further map criminal networks. This takedown highlights cybercriminals’ growing use of specialized laundering platforms to enable ransomware and account takeover monetization at scale. As regulatory scrutiny intensifies and attacker infrastructure becomes more modular and resilient, law enforcement action against these enablers is an increasing priority.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
WhatsApp GhostPairing: How Device Linking Fueled 2024 Account Hijacks
Financial Services10 months ago

WhatsApp GhostPairing: How Device Linking Fueled 2024 Account Hijacks

In mid-2024, threat actors launched a sophisticated social engineering campaign dubbed 'GhostPairing' to hijack WhatsApp accounts by abusing the platform's legitimate device-linking feature. Attackers initiated account compromise by tricking victims into sharing pairing codes, which allowed unauthorized access to their WhatsApp accounts on new devices without triggering standard multi-factor authentication. Once inside, attackers could impersonate victims, access chat histories, and leverage compromised accounts for further malicious activity. The attack exploited inherent trust in WhatsApp's device linking and its secure communication channels, highlighting risks even in end-to-end encrypted environments. This incident underscores the growing trend of attackers subverting user authentication processes, exploiting legitimate features for account takeover, and using highly convincing social engineering methods. With messaging apps central to both business and personal communications, the security and user-awareness gaps demonstrated here remain acutely relevant.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Cisco 2025 AsyncOS Zero-Day: UAT-9686 Exploitation of Email Gateway Appliances
Government Administration10 months ago

Cisco 2025 AsyncOS Zero-Day: UAT-9686 Exploitation of Email Gateway Appliances

In late November 2025, Cisco discovered a major cybersecurity incident involving active exploitation of an unpatched zero-day vulnerability (CVE-2025-20393) in its AsyncOS operating system, impacting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. The flaw, leveraged exclusively on internet-facing appliances with non-standard configurations, enables remote code execution as root when the Spam Quarantine feature is exposed. Attribution points to UAT-9686, a Chinese-nexus advanced persistent threat actor, utilizing malware such as AquaShell, AquaTunnel, Chisel, and AquaPurge for backdoor access, lateral movement, and log deletion. The campaign has resulted in persistent compromise, requiring full appliance rebuilds for remediation. This incident underscores the persisting risk that unpatched zero-days pose to enterprise infrastructure, particularly from advanced threat actors using sophisticated malware implant chains. It illustrates a broader industry trend of increasingly swift exploitation of newly discovered vulnerabilities and public toolkits by nation-state actors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports