Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
WSUS Windows Server Vulnerability Exploited: What Organizations Need to Know in 2024
In June 2024, attackers began actively exploiting a critical-severity vulnerability in Microsoft’s Windows Server Update Services (WSUS), allowing unauthenticated remote code execution on unpatched Windows Server instances. Public proof-of-concept exploit code enabled threat actors to target organizations’ update infrastructure, potentially granting attackers elevated privileges and control over networked endpoints. The attack vector leverages unencrypted or weakly secured WSUS communication endpoints, risking malware delivery or the propagation of malicious updates across enterprise environments. Immediate business impacts can include system compromise, lateral movement, and potential data exfiltration. This exploitation reflects a recent trend where attackers leverage highly impactful remote code execution bugs in widely deployed software with public exploits, underscoring the need for rapid patch management and improved east-west traffic visibility. Organizations using legacy or unpatched WSUS deployments are most at risk as targeted attacks continue to rise.
8 months ago
Kill Chain
Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild
In October 2025, Microsoft disclosed and urgently patched a critical remote code execution vulnerability (CVE-2025-59287) impacting the Windows Server Update Services (WSUS) framework. Following the public release of a proof-of-concept exploit, threat actors began actively targeting vulnerable WSUS deployments to execute malicious code, gain unauthorized access, and potentially compromise large segments of enterprise environments. The flaw, assigned a CVSS score of 9.8, allowed unauthenticated attackers to leverage exposed update services, posing significant risk to organizations’ patch management infrastructures before the emergency fix was implemented. This incident highlights the continuing trend of sophisticated adversaries exploiting zero-day and n-day vulnerabilities in widely used systems with available PoCs. It also underscores growing urgency for proactive patch management, real-time anomaly detection, and adoption of Zero Trust models to protect against rapidly weaponized threats.
8 months ago
Kill Chain
Global Smishing Triad Campaign: 194,000 Malicious Domains Power Massive Phishing Surge
In 2024, security researchers attributed a global smishing campaign to a threat group known as the Smishing Triad, which registered more than 194,000 malicious domains since January 1. Utilizing infrastructure predominantly registered through Hong Kong-based providers with Chinese nameservers, the actors orchestrated widespread phishing via SMS attacks targeting banking, logistics, and other sectors. Victims received highly targeted text messages that redirected them to credential-harvesting sites, leading to financial fraud and data compromise. The campaign’s scale and global reach underline the adversaries’ operational sophistication and heavy use of automation. This incident reflects a broader surge in phishing tactics leveraging SMS and vast domain infrastructure, bypassing traditional email security. The growing adoption of QR and mobile-first communication further widens the threat surface, putting regulatory and compliance emphasis on new vectors.
8 months ago
Kill Chain
Salt Typhoon’s 2024 Attack: Nation-State Espionage Exploits Forgotten Network Devices
In early 2024, a cyber espionage campaign orchestrated by the China-linked Salt Typhoon group targeted forgotten and unpatched network perimeter devices, such as out-of-support routers, VPNs, and firewalls, across both public and private sector organizations in the U.S. and allied nations. Adversaries leveraged advanced "living off the land" tactics, establishing persistent access by exploiting technical debt and overlooked legacy hardware—bypassing hardened endpoint defenses and moving laterally within affected networks. Operational impacts included exposure of sensitive credentials, long-term surveillance risks, and significant challenges in incident detection and response due to the stealthy nature of the attacks. This incident highlights a surge in sophisticated nation-state threats adapting to improved endpoint security by targeting unmanaged infrastructure. The campaign underscores the urgency for organizations to reassess asset inventories, prioritize decommissioning of end-of-life devices, and deploy proactive detection strategies, as similar tactics are increasingly observed across multiple state-sponsored and ransomware actors.
8 months ago
Kill Chain
Atlas & Comet AI Sidebar Spoofing: How Attackers Are Hijacking Trust in Browser AI
In early June 2024, security researchers identified a novel application security vulnerability affecting OpenAI’s Atlas and Perplexity’s Comet browsers. Attackers leveraged spoofed AI sidebars to present malicious, AI-generated instructions that duped users into actions compromising security, such as running unverified commands or visiting phishing sites. The attack method bypassed traditional endpoint defenses by exploiting inherent trust in AI-powered browser features. Though no widespread exploitation has been confirmed, proof-of-concept demonstrations exposed a significant risk of credential theft, data leakage, or lateral movement within enterprise environments. The rapid adoption of AI assistants made this vector both timely and dangerous. This incident highlights the growing trend of attackers targeting AI-powered productivity tools by manipulating contextual interfaces. Rising adoption of AI chatbots and browser plugins increases the threat surface, demanding urgent reevaluation of security controls and staff awareness. Regulatory scrutiny of AI and application security is expected to accelerate in response.
8 months ago
Kill Chain
CISA Sounds Alarm: Lanscope Endpoint Manager Flaw Actively Exploited
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) warned organizations of active exploitation of a critical vulnerability in Motex’s Lanscope Endpoint Manager software. Threat actors leveraged the flaw (tracked as CVE-2024-27956) to gain unauthorized access and potentially execute remote code on unpatched systems. The attackers could bypass authentication and gain administrative privileges, enabling lateral movement and further compromise of affected network environments. The incident impacted enterprises using Lanscope Endpoint Manager for device monitoring and management, raising concerns over exposure of sensitive data and operational disruption. This incident is notable for its speed of exploitation following public disclosure, illustrating the ongoing trend of threat actors rapidly weaponizing software vulnerabilities in endpoint management tools. The breach underscores the importance of immediate patching and rigorous monitoring as attackers increasingly target IT infrastructure software to establish initial footholds.
8 months ago
Kill Chain
CISA Confirms Critical Lanscope Endpoint Manager Vulnerability Under Active Attack
In October 2025, a critical vulnerability (CVE-2025-61932, CVSS 9.3) in Motex Lanscope Endpoint Manager was added to CISA’s Known Exploited Vulnerabilities catalog after confirmed active exploitation in the wild. Attackers leveraged the on-premises endpoint management platform’s remote code execution flaw to obtain unauthorized access, enabling lateral movement and potential data exfiltration. Organizations relying on Lanscope Endpoint Manager may face business disruption, data integrity issues, and heightened regulatory scrutiny as a result of this exposure. The recent exploitation of this vulnerability underscores a larger trend of remote code execution exploits targeting widely deployed endpoint management products. With attackers increasingly seeking supply-chain and IT management footholds, regulatory bodies and security leaders are prioritizing rapid patch cycles and robust segmentation to limit risk.
8 months ago
Kill Chain
It Only Takes 250 Documents to Poison Any Large Language Model – Security Implications for 2024
In 2024, cybersecurity researchers demonstrated that the integrity of large language models (LLMs) can be severely compromised with as few as 250 poisoned documents strategically inserted into their training data. By covertly introducing manipulated or malicious content into public data sources, attackers can alter a model’s understanding, bias its outputs, or degrade its reliability. This proof-of-concept highlights that ‘data poisoning’ attacks require minimal input yet pose substantial risk for AI reliability, potentially opening the door for misinformation, backdoors, or loss of operational trust across industries leveraging AI. Organizations relying on LLMs for critical tasks face a heightened threat of silent, hard-to-detect breaches affecting their core AI deployments. The urgency around AI/ML supply chain security has intensified, as threat actors and researchers increasingly explore the feasibility of data poisoning. Regulatory frameworks and industry best practices now emphasize the need for data provenance controls and continuous integrity monitoring of training pipelines.
8 months ago
Kill Chain
F5 Vulnerability Exposes Visibility Gaps in DHS’s CDM Program
In June 2024, a critical vulnerability affecting F5 devices exposed a major blind spot within the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program, which is tasked with overseeing federal cybersecurity assets. The Cybersecurity and Infrastructure Security Agency (CISA) was forced to issue an emergency directive after learning that a nation-state actor had exploited F5 edge devices to gain persistent access across multiple civilian federal agencies. The directive revealed that while thousands of F5 systems were in use, there was significant uncertainty about their location due to gaps in federal asset inventory capabilities, particularly for internet-facing edge devices like F5 BIG-IP load balancers. As a result, agencies had to scramble to manually identify and secure affected systems, highlighting the operational impact of incomplete visibility and asset management. The incident underscores the growing risks associated with network edge devices, which have become prime targets for sophisticated attackers exploiting gaps outside traditional IT inventories. As cloud adoption and edge architectures proliferate, ensuring asset visibility and securing non-traditional endpoints have become urgent priorities for government and private sector organizations alike, as attackers increasingly exploit these visibility gaps.
8 months ago
Kill Chain
Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge
In 2024, security researchers tracked a surge in activity from a sophisticated smishing (SMS phishing) group known as Smishing Triad, a decentralized operation managed in Chinese, leveraging a network of over 195,000 malicious domains to steal sensitive information globally. Domains impersonated critical sectors—including U.S. postal services, financial firms, healthcare, e-commerce, and government agencies—with the majority hosted in the U.S., China, and Singapore. Cross-functional threat actors orchestrated attacks via mobile messaging and Telegram forums, evolving tactics to avoid detection; most domains were short-lived, amplifying evasion and operational scale. This incident stands out for its scale, rapid infrastructure cycling, and global targeting, highlighting rising threats from organized smishing groups. The continued proliferation of phishing-as-a-service operations, increasing attacker collaboration, and adoption of short-lived domain infrastructures demonstrate the urgent need for improved east-west security controls, rapid detection, and stronger identity-based segmentation.
8 months ago
Kill Chain
FinWise Data Breach 2024: When Encryption Is the Last Line of Defense
In early 2024, FinWise, a financial services provider, suffered a significant data breach traced to an insider threat that circumvented internal security controls. The attacker exploited inadequate encryption of sensitive data in transit, extracting customer records via lateral movement across poorly segmented network segments. Because traffic was not properly encrypted, packet sniffing allowed the attacker to collect financial and personal data largely undetected for several weeks. The breach led to loss of confidential information, potential regulatory scrutiny, and reputational harm for FinWise. This incident highlights a rising wave of insider threats exploiting deficiencies in east-west traffic security and underscores the importance of robust, end-to-end encryption as regulatory bodies tighten requirements for securing data in transit and at rest across hybrid and multi-cloud environments.
8 months ago
Kill Chain
TARmageddon: Rust async-tar Supply Chain Flaw Leads to Critical RCE Risk
In June 2024, security researchers disclosed a critical vulnerability known as 'TARmageddon' in the abandoned Rust async-tar library and its forks. Attackers can exploit the flaw to achieve remote code execution (RCE) on systems using unpatched versions of the library, commonly found in developer tools and backend infrastructure. As async-tar remains unmaintained, organizations relying on affected forks or software inherit the vulnerability, potentially allowing initial compromise and lateral movement within supply chains. The flaw highlights the cascading risks of dependencies on abandoned open-source components, increasing the likelihood of stealthy supply-chain attacks bypassing traditional controls. This incident underscores a growing trend of adversaries targeting open-source software supply chains, particularly by exploiting abandoned or under-maintained libraries. The complexity and opacity of modern dependency trees, alongside escalations in software bill of materials (SBOM) scrutiny, make proactive vulnerability management and real-time supply-chain threat detection essential for reducing risk.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports