Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Pwn2Own Ireland 2025: 56 Zero-Day Vulnerabilities Exposed in One Day
In May 2025, security researchers at the Pwn2Own Ireland contest successfully exploited 56 previously unknown zero-day vulnerabilities across a broad range of consumer and enterprise devices—including the latest Samsung Galaxy S25 smartphone—over the course of a single day, earning nearly $793,000 in rewards. Participants used advanced exploitation chains targeting device software, firmware, and novel attack surfaces to gain remote code execution and bypass layered security controls. The demonstration of these critical flaws underlined the sophistication of contemporary offensive security techniques and the persistent risk posed by undiscovered vulnerabilities in modern technology stacks. Vendors were immediately notified, but the affected products are widely used globally. This incident exemplifies the accelerating pace and scale at which new vulnerabilities are uncovered, often by highly skilled researchers using techniques similar to those seen in active threat landscapes. Organizations are facing increased regulatory pressure to address zero-day risks and are urged to respond rapidly to vendor advisories and emerging disclosures.
8 months ago
Kill Chain
TARmageddon: Remote Code Execution Risk in Popular Async-Tar Rust Library Uncovered (2025)
In late August 2025, researchers uncovered TARmageddon (CVE-2025-62518), a high-severity supply-chain vulnerability in the async-tar Rust library and its forks, including tokio-tar. This flaw could permit remote code execution (RCE) when processing maliciously-crafted tar archives, posing a significant risk to downstream applications and platforms relying on these libraries for file extraction and archive handling. Successful exploitation opens the door to system compromise, data loss, or service interruption for potentially thousands of applications leveraging async-tar in production workloads. This incident highlights the growing threat of software supply-chain vulnerabilities, especially within open-source dependencies widely adopted across cloud-native and DevSecOps environments. Organizations must closely monitor dependencies, establish strong vulnerability management pipelines, and rapidly respond to disclosures as attackers increasingly target the software supply chain.
8 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
8 months ago
Kill Chain
China-Nexus Threat Actors Weaponize 'Nezha' RAT for Stealthy Campaigns in 2024
In early 2024, cybersecurity researchers uncovered a new campaign by China-nexus threat actors leveraging the open source "Nezha" remote access tool (RAT) to facilitate covert network access and persistence. Unlike traditional RMM (Remote Monitoring and Management) abuse, the adversaries deployed Nezha across multiple victim environments to enable encrypted traffic tunneling, conduct command-and-control operations, and bypass security controls. Targeting enterprises in various sectors, the attackers exploited weak access controls and east-west network traffic to establish lateral movement pathways, with the operation resulting in significant risks to sensitive data and business continuity. This incident highlights an accelerating trend in the use of open source, commodity tools by nation-state-aligned actors to evade detection and complicate attribution. The campaign reflects shifting threat dynamics, as attackers weaponize cloud-native techniques and legitimate tools to target organizations seeking to modernize security controls and comply with frameworks such as NIST and PCI DSS.
8 months ago
Kill Chain
LockBit, Qilin & DragonForce Forge Ransomware Cartel in 2024
In early 2024, notorious ransomware groups LockBit, Qilin, and DragonForce announced a strategic partnership, effectively forming a collaborative ransomware 'cartel.' This alliance has seen these gangs pooling resources, intelligence, and attack methods, shortly after the release of LockBit 5.0. By inviting other e-crime affiliates, they have expanded their operational reach and attack surface across multiple industries. The cartel model increases both the speed and sophistication of attacks, complicating defenders' response and extending the lifecycle of compromised environments for criminal profit. The incident is particularly relevant as it signals a new phase in ransomware operations, with threat actors adopting formal, syndicate-like coordination. It highlights escalating risks for enterprises, as collective intelligence sharing among attackers can quickly disrupt even mature security postures.
8 months ago
Kill Chain
Chaos Ransomware's C++ Upgrade: The 2024 Threat Every Enterprise Must Face
In early 2024, the Chaos Ransomware-as-a-Service operation unleashed a potent new C++ variant, featuring advanced encryption, wiper functionalities, and cryptocurrency-stealing modules. This evolution targets a broad array of victims by leveraging aggressive lateral movement across networks, rapid data encryption, and selective data destruction to intensify pressure on organizations. The threat actors deploy sophisticated evasion tactics and can pivot across cloud and hybrid infrastructures, resulting in operational disruptions and financial losses, especially in environments lacking east-west traffic controls and advanced detection capabilities. The Chaos ransomware upgrade exemplifies a broader trend of rapidly advancing ransomware toolkits integrating destructive and extortion-focused modules. With a spike in cross-industry ransomware incidents and escalating regulatory pressure to remediate compliance gaps, organizations must urgently reevaluate defenses, with emphasis on segmentation, visibility, and high-speed encrypted traffic controls.
8 months ago
Kill Chain
SonicWall 2024: Every Cloud Firewall Backup Breached in Major Supply Chain Attack
In June 2024, SonicWall confirmed that the previously disclosed breach of its cloud backup service was far more extensive than initially announced. The attack resulted in unauthorized access to firewall configuration backups for 100% of customers using SonicWall's cloud backup platform, rather than the 5% originally estimated. The compromise exposed sensitive customer network data, including credentials and VPN configurations, after attackers exploited vulnerabilities in SonicWall’s systems. This breach underscores significant supply chain risks, as attackers targeted third-party-managed infrastructure to circumvent perimeter defenses. This incident highlights the rising threat of supply chain attacks targeting security vendors themselves, which can expose downstream customer environments. With increasing regulatory scrutiny and heightened awareness of lateral movement risks across managed services, organizations must revisit both technical and vendor controls to ensure comprehensive zero trust segmentation and backup protection.
8 months ago
Kill Chain
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
8 months ago
Kill Chain
Nation-State Ransomware: Storm-2603 Exploits Velociraptor in 2024 Attacks
In early 2024, the Storm-2603 threat group, attributed to Chinese nation-state actors, conducted a series of ransomware campaigns leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool. By abusing Velociraptor, the attackers achieved persistent access, lateral movement, and stealthy data collection within targeted corporate environments. The group exploited weaknesses in east-west traffic security and endpoint controls, using legitimate tooling to evade detection and deploy ransomware payloads, leading to operational disruption and potential data exfiltration for multiple organizations. This incident highlights an escalation in adversaries’ use of legitimate IT and forensics tools for malicious purposes, complicating detection strategies. It exemplifies the growing threat of "living-off-the-land" tactics, where attackers blend in with standard operations, underscoring the need for improved anomaly detection, zero trust segmentation, and lateral movement controls.
8 months ago
Kill Chain
Feds Dismantle ShinyHunters' Salesforce Extortion Hub: Lessons for Cloud Security
In June 2024, U.S. federal authorities dismantled an extortion portal run by the notorious ShinyHunters group, which was used to threaten Salesforce victims after a reported compromise. ShinyHunters is known for data theft and double-extortion tactics, leveraging public leaks and ransom demands to extort organizations. Despite law enforcement takedown efforts, the group's threats remain active, targeting businesses that rely on Salesforce for their customer and operational data. The attack highlights risks surrounding third-party SaaS platforms and sophisticated cybercriminal techniques that exploit sensitive, cloud-based systems for extortion. This event underscores the accelerating landscape of data extortion and the persistent threat from established ransomware and data-leak actors. As organizations increasingly depend on SaaS providers, regulators and enterprises are intensifying focus on zero trust access, east-west traffic security, and layered controls to contain lateral movement and prevent sensitive data exposure.
8 months ago
Kill Chain
Pixnapping Attack: How Android 2FA Was Bypassed in 2024
In early 2024, researchers discovered a novel mobile vulnerability known as the 'Pixnapping' attack, which targeted Android applications to circumvent two-factor authentication (2FA) mechanisms. The attack leverages cleverly crafted overlays to capture sensitive information directly from protected apps such as Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo. While there is no evidence of widespread exploitation, the proof-of-concept demonstrates that malicious apps with appropriate permissions could bypass Android security boundaries, enabling attackers to steal both credentials and 2FA tokens, thereby jeopardizing highly sensitive user data on compromised devices. This incident underscores the urgent need for stronger in-app security controls and constant vigilance regarding permission granularity on mobile platforms. As more threat actors focus on mobile endpoints and multi-factor authentication, organizations and users must adapt their defenses to counter increasingly sophisticated and evasive attack methods.
8 months ago
Kill Chain
Microsoft's October 2025 Zero-Day Storm: What the Massive Patch Update Means for Your Business
In October 2025, Microsoft released a massive Patch Tuesday security update addressing over 100 vulnerabilities across its product suite, including multiple actively exploited zero-days and several high-severity privilege escalation flaws. Threat actors leveraged some of these unpatched vulnerabilities to gain elevated access to enterprise and government systems, exploiting both on-premises and cloud workloads. The update also marked the final round of Windows 10 security patches, raising urgency for legacy system owners to upgrade in order to remain protected. The overall business impact included increased risk of lateral movement, data exfiltration, service disruptions, and heightened remediation costs for organizations slow to patch. This incident underscores an ongoing trend of attackers rapidly weaponizing newly disclosed vulnerabilities, as well as the growing threat facing organizations who rely on end-of-life software. The scale and speed of exploit adoption highlight the critical importance of vulnerability management and proactive patching as top security priorities.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports