Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 225 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2689–2700 / 3497 reports
Fortinet 2024 Auth Bypass Exploited: Urgent Actions for Network Security
Financial Services10 months ago

Fortinet 2024 Auth Bypass Exploited: Urgent Actions for Network Security

In early June 2024, threat actors actively exploited newly disclosed authentication bypass vulnerabilities in multiple Fortinet products, including FortiOS and FortiProxy. Attackers leveraged these flaws (notably CVE-2024-21762 and CVE-2024-23113) shortly after Fortinet's patch release, gaining unauthorized admin-level access to vulnerable devices. The intruders then extracted system configuration files, risking exposure of sensitive network data and credentials. Several organizations reported compromises and system disruptions, prompting urgent advisories from Fortinet and government agencies to patch immediately and review system integrity. This incident underscores a dangerous trend: rapid mass exploitation of zero-day vulnerabilities in network security devices. The high-profile breach highlights mounting risks to organizations that delay critical patching and demonstrates the persistent targeting of edge appliances by sophisticated attackers.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GhostPoster: Malicious Firefox Addon Logos Expose Supply Chain Security Risks
Computer Software/Engineering10 months ago

GhostPoster: Malicious Firefox Addon Logos Expose Supply Chain Security Risks

In early 2024, a supply chain attack campaign known as 'GhostPoster' was uncovered targeting users of malicious Firefox browser extensions. Threat actors embedded obfuscated JavaScript payloads within the image logos of these add-ons, leveraging steganography to evade detection and distribute malware. Once installed, the trojanized extensions—with more than 50,000 downloads—granted actors persistent access to victims' browsers, allowing for activity monitoring and enabling backdoor capabilities. The campaign exploited the trust in official browser markets while circumventing traditional security measures. This breach illustrates the rising sophistication of supply chain attacks, particularly those leveraging legitimate software distribution channels. It highlights the necessity for stronger internal and external vetting of browser add-ons, as the technique is being replicated across other software ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
APT Groups Leverage React2Shell to Plant Linux Backdoors in 2025
Computer Software/Engineering10 months ago

APT Groups Leverage React2Shell to Plant Linux Backdoors in 2025

In December 2025, security researchers from Palo Alto Networks Unit 42 and NTT Security discovered active exploitation of the React2Shell vulnerability targeting Linux environments worldwide. The attackers leveraged this flaw in unpatched systems to deploy advanced remote access tools such as KSwapDoor and ZnDoor. These malware families provided persistent backdoor access, enabling lateral movement and data exfiltration. The campaign was characterized by sophisticated evasion techniques, stealthy command-and-control channels, and targeted critical infrastructure, raising the risk of operational disruption and regulatory exposure for affected organizations. The exploitation of React2Shell reflects a broader surge in advanced persistent threat (APT) activity focused on Linux workloads, with threat actors increasingly targeting vulnerabilities in remote access and open-source software. This trend underscores the urgent need for enhanced east-west traffic security, rapid patching, and anomaly detection to prevent organizational compromise.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Active Attack: Fortinet FortiGate SAML SSO Authentication Bypass Exposes Networks
Financial Services10 months ago

Active Attack: Fortinet FortiGate SAML SSO Authentication Bypass Exposes Networks

In December 2025, threat actors began exploiting two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719, both CVSS 9.8) in Fortinet FortiGate appliances. By targeting the FortiCloud SSO feature—enabled during FortiCare registration—they leveraged crafted SAML messages to gain unauthorized access to admin accounts. Once inside, attackers exported device configuration files, risking credential compromise and broader network infiltration. The U.S. CISA quickly classified the flaws as Known Exploited Vulnerabilities, urging immediate patching. This incident demonstrates the evolving risk of identity-driven network attacks and rapid exploitation following vulnerability disclosure. With opportunistic threat actors targeting edge infrastructure, similar authentication-based attacks are likely to increase, further incentivized by regulatory and industry pressure for swift vulnerability management.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cellik Android Malware: The New Frontier for Trojanized Google Play Apps
Banking/Mortgage10 months ago

Cellik Android Malware: The New Frontier for Trojanized Google Play Apps

In December 2025, cybersecurity researchers identified a new Android malware-as-a-service (MaaS) dubbed Cellik that enables cybercriminals to create malicious variants of popular Google Play Store apps. Distributed via underground forums, Cellik’s service allows threat actors to select legitimate apps, inject sophisticated malware, and maintain original app functionality, thereby bypassing typical user suspicion and potentially evading Google Play Protect. Cellik's features include real-time screen streaming, notification interception, filesystem browsing, data exfiltration, device wiping, and encrypted command-and-control communications. Attackers can also overlay fake login screens, inject malicious payloads into trusted apps, and exploit a hidden browser to steal credentials using stored cookies from infected devices. The emergence of Cellik signals an evolution in Android threat tooling, where MaaS kits empower less skilled actors to launch advanced attacks. This development heightens risks for organizations subject to mobile threats as attackers embrace more modular and evasive tactics, underlining the urgent need for advanced mobile security controls and proactive user education.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Inside the 2025 KPop Malware Hunter Takedowns: Exposing Cloud Attack Trends
Computer/Network Security10 months ago

Inside the 2025 KPop Malware Hunter Takedowns: Exposing Cloud Attack Trends

In 2025, a coordinated intelligence operation led by an international alliance of cybersecurity researchers, dubbed the KPop Malware Hunters, dismantled several prolific malware campaigns targeting global cloud and data center environments. Threat actors, including the group Salt Typhoon, exploited east-west traffic routes and unencrypted data in transit to achieve lateral movement post-compromise. Using advanced encrypted traffic analytics and inline IPS, defenders identified high-volume command-and-control exchanges masked within routine inter-region traffic. The operation led to significant disruption of adversary infrastructure, restoration of business operations, and improved threat visibility for impacted organizations worldwide. This takedown is highly relevant amid heightened attacks on hybrid and multicloud architectures, where sophisticated adversaries increasingly exploit internal cloud pathways and vulnerable segmentation. 2025’s events spotlight the urgent need for zero trust, inline threat detection, and rigorous compliance alignment as attackers leverage AI-driven evasion and cloud-native persistence.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Compromised IAM Credentials Fuel AWS Cryptomining Attack in 2025
Information Technology/IT10 months ago

Compromised IAM Credentials Fuel AWS Cryptomining Attack in 2025

In November 2025, Amazon Web Services (AWS) became the target of a widespread cryptomining campaign exploiting compromised Identity and Access Management (IAM) credentials. The attackers used stolen keys to access AWS accounts, deploy cryptomining operations, and leverage persistence mechanisms to avoid detection and maintain access. Amazon’s GuardDuty threat detection tools were instrumental in uncovering the activity, which leveraged novel Tactics, Techniques, and Procedures (TTPs) including lateral movement and privilege escalation, putting customer cloud resources and budgets at risk through accelerated resource consumption and possible data exposure. This incident is emblematic of an escalating trend where threat actors exploit cloud identity weaknesses for financial gain. It underscores the urgent necessity for robust multi-factor authentication, real-time anomaly detection, and comprehensive cloud security strategies as identity-driven attacks proliferate in the cloud era.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
CISA Flags Fortinet CVE-2025-59718: Improper Signature Verification Under Active Exploitation
Government Administration10 months ago

CISA Flags Fortinet CVE-2025-59718: Improper Signature Verification Under Active Exploitation

In December 2025, CISA added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation targeting Fortinet's multiple products. This vulnerability involves improper verification of cryptographic signatures, allowing attackers to bypass security controls, execute unauthorized code, or escalate privileges on affected devices. Federal agencies, per BOD 22-01, must remediate this critical issue by the mandated deadline to protect their networks. The flaw’s exploitation risks device compromise and potential lateral movement by sophisticated threat actors, with broad implications for data integrity and operational continuity across affected organizations. This alert reflects the escalating trend of attackers rapidly weaponizing supply chain or cryptographic flaws in core network infrastructure. As organizations increasingly rely on complex integrations and encrypted communications, such vulnerabilities underscore persistent challenges in managing risk and ensuring trust in critical systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
8 Million Users' AI Conversations Exposed: Urban VPN Browser Extension's Hidden Data Harvest
Computer Software/Engineering10 months ago

8 Million Users' AI Conversations Exposed: Urban VPN Browser Extension's Hidden Data Harvest

In December 2025, security researchers exposed that the popular Urban VPN Proxy browser extension—marketed for privacy—was actively harvesting and exfiltrating sensitive conversation data from over eight million users interacting with leading AI chatbot platforms such as ChatGPT, Claude, Gemini, and Copilot. The malicious behavior was introduced in versions released after July 2025, with the extension injecting scripts into browser sessions to intercept, package, and transmit users’ chatbot prompts, responses, and session metadata to servers operated by Urban VPN’s parent, BiScience, a known data broker. Users were not offered any meaningful way to disable this data collection besides uninstalling the extension, and the privacy disclosure was deeply buried within the setup process, leaving the majority unaware. This incident underscores the growing risk posed by privacy-violating browser extensions, especially those with elevated reputations and millions of installations. As AI assistants become repositories for sensitive personal and corporate data, the implications of such data leaks—from regulatory compliance to business confidentiality—are amplified, driving urgent reassessment of browser extension governance and AI data security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How Google's 2024 Research Uncovered Chinese APT Exploitation of React2Shell
Telecommunications10 months ago

How Google's 2024 Research Uncovered Chinese APT Exploitation of React2Shell

In June 2024, Google's Threat Analysis Group expanded the attribution of recent attacks exploiting the critical "React2Shell" remote code execution vulnerability to at least five more Chinese nation-state hacking groups. These attackers leveraged the unpatched React2Shell flaw to gain unauthorized access to systems across multiple sectors, using sophisticated spear-phishing and lateral movement techniques to deploy malware and establish persistence. The affected organizations experienced potential data exposure, operational interruptions, and increased remediation costs while scrambling to patch impacted environments. This incident highlights the evolving capabilities and coordination among multiple Chinese APTs targeting software supply chain weaknesses. The React2Shell exploitation surge demonstrates a significant escalation in the speed and scale of zero-day abuse by coordinated state-affiliated groups. Organizations face heightened urgency to accelerate vulnerability management and enhance east-west traffic monitoring as attackers rapidly weaponize public vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
VolkLocker Ransomware Thwarted by Leaked Master Key: Lessons from the CyberVolk 2025 Attack
Financial Services10 months ago

VolkLocker Ransomware Thwarted by Leaked Master Key: Lessons from the CyberVolk 2025 Attack

In August 2025, the pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) launched VolkLocker, a new ransomware-as-a-service aimed at both Windows and Linux systems. SentinelOne researchers discovered that VolkLocker suffered a critical security flaw: a hard-coded master key was inadvertently left in test artifacts, enabling anyone to decrypt files encrypted by the ransomware, bypassing ransom payments. Attackers used typical RaaS deployment methods, leveraging phishing and malicious attachments for initial access. While the group attempted to extort victims, the encryption flaw significantly undermined their efforts. The incident highlights the increased frequency and complexity of ransomware-as-a-service offerings, while underscoring the role of sloppy operator security in containing damage. As similar attacks proliferate, organizations must prioritize incident response and security validation against emerging threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Critical Apple 0-Days and WinRAR Exploits: How Multi-Vector Threats Changed 2025
Computer Software/Engineering10 months ago

Critical Apple 0-Days and WinRAR Exploits: How Multi-Vector Threats Changed 2025

In December 2025, a wave of critical zero-day vulnerabilities targeting Apple devices, WinRAR, OAuth implementations, and the .NET framework was actively exploited by various cybercriminal groups. Attackers leveraged these flaws to bypass authentication mechanisms, execute remote code, and escalate privileges across both consumer and enterprise environments. Notably, some exploits were weaponized in the wild before official patches became available, resulting in widespread exposure of unencrypted traffic, unauthorized access to internal networks, and large-scale credential theft. Organizations experienced data breaches, ransomware infections, and regulatory scrutiny, particularly where weak segmentation or inadequate traffic visibility allowed lateral movement. This incident highlights the persistent threat posed by simultaneous multi-vector exploits, especially as attackers rapidly adopt new vulnerabilities in mainstream software. Increased regulatory focus on immediate patching and advanced segmentation underscores the necessity for robust, real-time threat detection and zero trust enforcement across hybrid and multi-cloud ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports