Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 235 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2809–2820 / 3497 reports
Cybercrime Goes SaaS: The Rise of Crime-as-a-Service in 2024
Financial Services10 months ago

Cybercrime Goes SaaS: The Rise of Crime-as-a-Service in 2024

In early 2024, cybersecurity researchers observed a surge in Crime-as-a-Service (CaaS) operations leveraging a subscription-based model. Attackers now rent access to advanced phishing kits, infostealer logs, Remote Access Trojans (RATs), and one-time password bots on popular chat platforms like Telegram, dramatically lowering the barrier to entry for cybercrime. These CaaS platforms enable even low-skilled actors to execute sophisticated intrusion campaigns targeting organizations across industries, often resulting in credential theft, ransomware outbreaks, and large-scale data breaches. This operational shift has enabled attackers to strike at scale and adapt quickly to new defenses, amplifying business risks and potential regulatory violations. The rise of CaaS signifies a pivotal threat evolution: democratized, on-demand cybercrime. Organizations must now address not just known threat actors, but a growing pool of opportunists leveraging plug-and-play hacking tools. This trend is accelerating, leading to urgent pressures for improved identity controls, network segmentation, and rapid anomaly detection.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Shai-Hulud 2.0: 2024 NPM Supply Chain Attack Exposes 400,000 Developer Secrets
Computer Software/Engineering10 months ago

Shai-Hulud 2.0: 2024 NPM Supply Chain Attack Exposes 400,000 Developer Secrets

In June 2024, the 'Shai-Hulud 2.0' campaign executed a large-scale supply chain attack against the JavaScript ecosystem by compromising over 750 packages on the NPM registry. Attackers used malicious dependencies to covertly exfiltrate environment variables and developer secrets to public GitHub repositories, exposing as many as 400,000 authentication credentials and tokens. The attack leveraged automation to rapidly disseminate malware and gather sensitive data from unwitting developers and CI systems, impacting thousands of organizations and potentially enabling downstream breaches. This incident underlines the growing risks of open-source supply chain vulnerabilities and highlights attacker innovation in automated credential harvesting. With supply chain attacks rising and developers relying on public package repositories, proactive controls and zero-trust practices have never been more essential to prevent code-integrity and data-exposure risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Inside the 2024 Korea IP Camera Mass-Hack: A Wake-Up Call for IoT Security
Hospitality10 months ago

Inside the 2024 Korea IP Camera Mass-Hack: A Wake-Up Call for IoT Security

In early 2024, South Korean authorities arrested four suspects for hacking into more than 120,000 IP cameras nationwide, exfiltrating sensitive video footage, and distributing it through a foreign adult website. Attackers exploited insecure and poorly configured IoT camera devices lacking adequate network segmentation or encrypted traffic, allowing for remote access and large-scale unauthorized surveillance. The breach exposed thousands of individuals to privacy violations and highlighted severe weaknesses in the deployment and security of IoT devices within residential and business environments. This incident underscores a rising trend of IoT device exploitation for privacy invasions, raising alarms globally about insufficient network protections and the urgency for robust segmentation, encrypted communications, and egress security policies as IoT adoption grows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Google Fixes 107 Android Vulnerabilities, Including 2 Exploited in the Wild
Banking/Mortgage10 months ago

Google Fixes 107 Android Vulnerabilities, Including 2 Exploited in the Wild

In June 2025, Google released a critical Android security update addressing 107 vulnerabilities across multiple subsystems, including Framework, System, and third-party vendor components such as Arm, MediaTek, and Qualcomm. Notably, two high-severity Framework vulnerabilities had been exploited in the wild prior to the patch, allowing attackers to potentially bypass defenses, execute code, or gain unauthorized access on unpatched devices. Attackers leveraged these flaws to target unsuspecting Android users before Google issued its advisory and fix, putting millions of devices at risk until users updated their software. This incident highlights the ongoing risk posed by zero-day vulnerabilities in widely used mobile platforms and the rapidity with which sophisticated threat actors exploit unpatched systems. The urgency of timely patching is reinforced, as targeted attacks on mobile users remain an attractive vector for cybercriminals and APT groups alike.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Malicious npm Package Outsmarts AI Security Tools in 2024 Supply Chain Breach
Computer Software/Engineering10 months ago

Malicious npm Package Outsmarts AI Security Tools in 2024 Supply Chain Breach

In February 2024, researchers identified a supply chain attack leveraging a malicious npm package named eslint-plugin-unicorn-ts-2, published under the guise of a TypeScript extension for ESLint by a user called "hamburgerisland." This package included hidden prompt injections and obfuscated scripts specifically designed to evade detection by AI-driven security scanners. Once integrated into a developer's project, it could execute unauthorized code, exfiltrate data, and potentially propagate laterally within developer environments. The attack highlighted how AI-oriented security tools can be manipulated through adversarial prompts and code concealment, putting countless downstream applications at risk in the dynamic JavaScript/Node.js ecosystem. The incident exemplifies sophisticated adversary adaptation, with attackers now actively engineering open-source supply chain threats to outsmart automated, AI-driven defenses. Organizations relying on package registries and automated code validation face urgent pressure to enhance both technical controls and threat intelligence around third-party dependencies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
CISA Flags Critical Android Framework Flaws in 2025: Urgent Action Required
Government Administration10 months ago

CISA Flags Critical Android Framework Flaws in 2025: Urgent Action Required

In December 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two newly discovered Android Framework vulnerabilities—CVE-2025-48572 (Privilege Escalation) and CVE-2025-48633 (Information Disclosure)—to its Known Exploited Vulnerabilities Catalog. These flaws, which have already been actively exploited in the wild, allow malicious actors to escalate privileges and potentially access sensitive data on affected Android devices. The vulnerabilities create substantial risk, particularly for federal agencies and enterprises relying on Android in their operations, prompting CISA to mandate urgent remediation under Binding Operational Directive 22-01. This incident highlights the persistent targeting of mobile platforms and increased sophistication in privilege escalation techniques observed by threat actors. Organizations are urged to prioritize patching and reinforce security monitoring, as the exploitation of unpatched Android vulnerabilities continues to fuel regulatory and cyber risk concerns in both public and private sectors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Unveils 2025 Critical ICS Vulnerabilities Affecting Industrial and Medical Sectors
Industrial Automation10 months ago

CISA Unveils 2025 Critical ICS Vulnerabilities Affecting Industrial and Medical Sectors

In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five separate advisories detailing multiple vulnerabilities discovered across widely deployed industrial control systems (ICS) products, including platforms from Industrial Video & Control, Iskra, Mirion Medical, and Mitsubishi Electric. These vulnerabilities range from improper authentication and unencrypted data flows to weak access controls and, if left unmitigated, could enable threat actors to compromise critical infrastructure, hijack remote operations, or disrupt medical and industrial processes. The affected organizations were notified, and remediation guidance was provided to reduce risk and limit exploitation by sophisticated actors. This disclosure underscores an ongoing trend of vulnerability discoveries in ICS environments, where legacy protocols, insufficient segmentation, and growing connectivity increasingly expose operational networks to targeted attacks. Continued disclosures by agencies like CISA emphasize the urgent need for robust visibility, segmentation, and zero trust architectures in protecting critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mirion Medical 2025: Critical Vulnerabilities in NMIS BioDose Software Threaten Healthcare Security
Health Care / Life Sciences10 months ago

Mirion Medical 2025: Critical Vulnerabilities in NMIS BioDose Software Threaten Healthcare Security

In December 2025, Mirion Medical disclosed multiple high-severity vulnerabilities affecting its EC2 Software NMIS BioDose product, versions prior to 23.0. These flaws—incorrect permission assignments, use of hard-coded credentials, and client-side authentication weaknesses—could be exploited by attackers to gain unauthorized access, elevate privileges, manipulate executables, steal sensitive medical data, or execute arbitrary code. Impacting the healthcare and public health sectors globally, these vulnerabilities pose critical operational and patient-data risks, especially in environments with networked installations and exposed Microsoft SQL Server databases. No active exploitation has yet been reported, but CISA urges urgent mitigation measures due to the vulnerabilities’ remote exploitability and low attack complexity. This incident highlights intensifying regulatory scrutiny on medical device security as threat actors increasingly target healthcare systems for sensitive patient data and intellectual property. The vulnerabilities in Mirion’s product underscore persistent gaps in authentication and privilege controls—a growing concern amid adoption of connected medical technologies and regulatory frameworks such as HIPAA and NIST.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Ransomware Halts CodeRED Emergency Alert System in 2024
Government Administration10 months ago

Ransomware Halts CodeRED Emergency Alert System in 2024

In June 2024, the CodeRED emergency alert platform experienced a major operational disruption after being targeted by the Inc ransomware gang. Attackers infiltrated the organization's systems, encrypted critical servers, and exfiltrated sensitive subscriber data, causing CodeRED to take its emergency alert services offline. Initial entry occurred through a phishing campaign, allowing lateral movement and the deployment of ransomware across east-west traffic. The attack compromised both the confidentiality and availability of data, significantly impacting public safety communication in affected regions. This incident highlights the escalating threat ransomware groups pose to critical infrastructure and public safety technology providers. As attackers target essential services with increasingly sophisticated methods, robust east-west security controls, zero trust segmentation, and real-time threat detection have become urgent priorities for organizations in all sectors.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
SharePoint 2025: ToolShell In-Memory Exploit Bypasses Defenses
Government Administration10 months ago

SharePoint 2025: ToolShell In-Memory Exploit Bypasses Defenses

In August 2025, Microsoft SharePoint servers were targeted by an advanced exploit chain known as ToolShell, leveraging newly disclosed vulnerabilities CVE-2025-53770 and CVE-2025-53771. Threat actors bypassed authentication and exploited deserialization flaws on on-premises SharePoint Server 2016, 2019, and Subscription editions. Initial attacks involved file-based web shells easily detected by EDRs, but adversaries quickly shifted to highly evasive in-memory payloads, rendering detection challenging and enabling the extraction of machine keys or the execution of PowerShell commands for data exfiltration and deeper system compromise. The incident underscores the growing risks of sophisticated post-exploit activity and lack of robust network detection. This breach highlights a wider threat: attackers are increasingly adapting their techniques to evade endpoint protections by using fileless, memory-resident malware and targeting enterprise collaboration platforms. As such attack patterns spread, organizations must urgently reinforce defenses and monitor network-level traffic for signs of exploitation, especially with remote work and critical business data gravitating to such platforms.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Issues Urgent Patch for 107 Android Vulnerabilities, Two Actively Exploited Zero-Days
Telecommunications10 months ago

Google Issues Urgent Patch for 107 Android Vulnerabilities, Two Actively Exploited Zero-Days

In December 2025, Google released a significant Android security update that addressed 107 vulnerabilities, including two zero-day flaws (CVE-2025-48633 and CVE-2025-48572) already being actively exploited in the wild. These high-severity issues in the Android framework allowed threat actors to access sensitive information and escalate privileges, posing a substantial threat to user data and device functionality. The update also remedied several critical vulnerabilities impacting the kernel, system, and multiple vendor components such as MediaTek, Unisoc, and Qualcomm. This incident highlights the intricate security landscape of mobile operating systems and the evolving tactics of cyber adversaries in exploiting vendor fragmentation and delayed patch cycles. The breadth and urgency of this patch reflects growing concerns around mobile platform vulnerabilities, especially as targeted exploitation of zero-days intensifies. With attackers rapidly leveraging gaps before they’re widely recognized or patched, organizations face increased pressure to maintain real-time vulnerability management and swift patch deployment to minimize exposure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ShadyPanda: 4.3 Million Impacted in Massive Malicious Browser Extension Attack (2024)
Financial Services10 months ago

ShadyPanda: 4.3 Million Impacted in Massive Malicious Browser Extension Attack (2024)

In early 2024, the ShadyPanda campaign targeted users of Chrome and Edge browsers by distributing over 4.3 million malicious extensions disguised as legitimate utilities. Attackers leveraged browser extension supply chains—often through fraudulent developer accounts and aggressive social engineering—to gain access to users’ browsing data, credentials, and sensitive online activity. The malware evolved over time, adapting to evade security controls and harnessing sophisticated capabilities to extract data, redirect web sessions, and facilitate persistent surveillance, affecting millions globally and highlighting gaps in browser marketplace vetting. This incident exemplifies a rapid escalation in supply-chain attacks focusing on widely used platforms like web browsers. The surge in malicious browser extension campaigns underscores the increasing sophistication of threat actors and the urgent need for organizations and individuals to be vigilant about third-party software, browser hygiene, and visibility into user-installed code.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports