Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 238 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2845–2856 / 3497 reports
Dartmouth College Data Breach: Clop Ransomware Targets Oracle EBS in 2024 Attack
Higher Education/Acadamia10 months ago

Dartmouth College Data Breach: Clop Ransomware Targets Oracle EBS in 2024 Attack

In March 2024, Dartmouth College confirmed a data breach after the Clop ransomware gang published confidential information allegedly exfiltrated from the institution's Oracle E-Business Suite servers. The attackers exploited a zero-day vulnerability (associated with the MOVEit Transfer incidents) and infiltrated the college’s systems, ultimately stealing sensitive data, including personal and financial records of students, faculty, and staff. Dartmouth detected suspicious activity following Clop’s dark web disclosures, began forensics, and reported the incident to regulatory agencies. Disruptions to business operations and heightened security controls followed, with legal notifications sent to affected parties. The Dartmouth breach highlights the persistent targeting of higher education by ransomware groups exploiting supply chain and enterprise software vulnerabilities. With ransomware attacks involving exfiltration and public data leaks surging in 2024, institutions face mounting regulatory pressure and reputational risks, underscoring the urgent need for robust segmentation, encrypted traffic controls, and real-time threat detection.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Banks and Governments Exposed: Code Beautifiers Leak Credentials in 2024
Banking/Mortgage10 months ago

Banks and Governments Exposed: Code Beautifiers Leak Credentials in 2024

In early 2024, researchers discovered that thousands of sensitive credentials, API keys, and authentication tokens belonging to global banks, government agencies, and technology companies were inadvertently exposed through public submissions to online code formatting tools such as JSONFormatter and CodeBeautify. These web-based beautifier platforms, commonly used by developers to format or debug code, were found to be storing users’ uploads—including confidential configuration files—in publicly accessible repositories without adequate warning or access control. As a result, threat actors could easily discover and exploit these exposed secrets to compromise critical infrastructure or initiate supply chain attacks. This incident underscores the ongoing risks of third-party tool usage in secure development lifecycles. With data exposures driven by everyday tooling, organizations face mounting regulatory and operational scrutiny to audit developer practices, harden supply chain security, and implement broader controls for inadvertent credential leakage.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users
Government Administration10 months ago

CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users

In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding active espionage campaigns exploiting commercial spyware and remote access trojans (RATs) to compromise high-value users on secure messaging apps including Signal and WhatsApp. Attackers utilized sophisticated social engineering techniques—such as phishing and malicious links—to covertly deliver malware, enabling unauthorized access to users' encrypted chats, sensitive attachments, and even device controls. The victims ranged from executives and journalists to government officials, highlighting the background emergence of advanced social engineering paired with novel spyware kit deployment. The incident triggered heightened scrutiny of both messaging app security and endpoint defense controls. This event is emblematic of a growing surge in targeted surveillance operations against individuals using encrypted communication platforms. It raises concern over the effectiveness of endpoint security, user awareness, and the need for proactive threat intelligence, while highlighting an evolution in adversary tactics toward cloud-based and identity-driven infiltration.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens
Financial Services10 months ago

ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens

In late 2025, the Advanced Persistent Threat (APT) group known as ToddyCat launched a sophisticated cyber espionage campaign targeting corporate environments across Europe and Asia. The attackers leveraged a new custom tool, TCSectorCopy, to steal Microsoft Outlook emails and Microsoft 365 OAuth 2.0 access tokens. By compromising user endpoints and abusing browser-based authentication flows, ToddyCat successfully exfiltrated sensitive email data and bypassed perimeter controls. The campaign, marked by its stealthy techniques, enabled attackers to maintain persistent access and move laterally within affected networks, significantly increasing the risk to sensitive enterprise communications and intellectual property. This incident highlights the growing reliance of threat actors on token theft and cloud-based attack vectors, posing new challenges for organizations with hybrid or cloud-first environments. It underscores the urgent need for advanced detection capabilities, Zero Trust network segmentation, and comprehensive identity protection strategies to counter emerging APT tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
The Shai-hulud Worm Returns: 2024 Supply Chain Malware Breach Analysis
Computer Software/Engineering10 months ago

The Shai-hulud Worm Returns: 2024 Supply Chain Malware Breach Analysis

In early 2024, cybersecurity researchers identified a resurgence of the Shai-hulud worm leveraging a novel infection vector in supply chain attacks. The new variant executes malicious code during software preinstall, exposing assets in both build and runtime environments before traditional defenses can activate. Attackers embedded the worm into widely-used application packages, facilitating undiscovered lateral movement and unauthorized access to sensitive data across multicloud and hybrid infrastructures. In several cases, the attack bypassed conventional endpoint protections and rapidly compromised internal east-west traffic, threatening operational availability and regulatory compliance for impacted organizations. This incident signals an evolution in malware tactics, underscoring the growing threat posed by supply chain attacks and sophisticated lateral movement in modern enterprise networks. The renewed Shai-hulud campaign highlights the urgent need for robust zero trust segmentation, encrypted data in transit, and real-time threat detection to counter risks targeting build pipelines and cloud-native workloads.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
ShadowRay 2.0: New Botnet Hijacks AI Clusters for Cryptocurrency Mining
Information Technology/IT10 months ago

ShadowRay 2.0: New Botnet Hijacks AI Clusters for Cryptocurrency Mining

In early 2024, cybersecurity researchers discovered that threat actors had exploited a vulnerability in the open-source Ray framework to infiltrate AI infrastructure in organizations worldwide. By abusing misconfigured or vulnerable Ray clusters, attackers deployed a self-propagating botnet named ShadowRay 2.0 that hijacked compute resources for unauthorized cryptomining and exfiltrated sensitive data. The campaign demonstrated advanced lateral movement across cloud workloads, showcasing AI services as lucrative targets and exposing gaps in east-west security and segmentation policies. Impact included disrupted operations, increased cloud costs, and exposure of confidential data, impacting both cloud-native and hybrid environments. This incident is a stark example of how attackers rapidly weaponize software flaws in emerging technologies like AI platforms. With the proliferation of open-source AI frameworks and increased integration into core business operations, misconfigurations and unpatched vulnerabilities become high-value entry points for financially motivated cybercriminals.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Oracle 2025 Identity Manager Breach: CVE-2025-61757 Exploited in New Extortion Campaigns
Financial Services10 months ago

Oracle 2025 Identity Manager Breach: CVE-2025-61757 Exploited in New Extortion Campaigns

In 2025, Oracle’s Identity Manager platform was found to have a critical vulnerability, designated CVE-2025-61757, which was actively exploited by threat actors. Attackers leveraged this flaw to gain unauthorized access, escalate privileges, and potentially move laterally across enterprise environments leveraging Oracle's identity suite. This campaign followed earlier Oracle Cloud security incidents and a notable extortion trend targeting Oracle E-Business Suite customers, raising concerns about the security posture of widely-deployed identity management systems. This breach underscores an urgent industry shift: as digital identity becomes the new security perimeter, attackers increasingly target identity infrastructure. The incident’s exploit path highlights the need for robust segmentation, real-time threat detection, and compliance-driven control across cloud and enterprise platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JackFix Attack: How Phishing Evolved to Outsmart ClickFix Defenses
Financial Services10 months ago

JackFix Attack: How Phishing Evolved to Outsmart ClickFix Defenses

In early June 2024, a new phishing campaign dubbed the 'JackFix' attack emerged, leveraging adaptations of the previously known ClickFix tactic to bypass recently implemented technical mitigations. Threat actors used sophisticated psychological manipulation and novel evasion techniques to bypass security controls and deceive end users into clicking malicious links. Once inside targeted environments, the attackers engaged in lateral movement and data exfiltration, exploiting inadequate segmentation and detection gaps. Organizations affected experienced compromised credentials, unauthorized access to sensitive systems, and increased risk of regulatory exposure due to the attack’s ability to blend with normal traffic. This incident underscores the rapid evolution of phishing methods in response to security improvements, highlighting the urgent need for layered defenses and zero trust segmentation. The JackFix attack is part of a wider trend of phishing campaigns that employ behavioral engineering and technical countermeasures, challenging legacy detection and policy frameworks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Shai-Hulud Worm: 2024 Supply-Chain Malware Targets npm and GitHub
Computer Software/Engineering10 months ago

Shai-Hulud Worm: 2024 Supply-Chain Malware Targets npm and GitHub

In early June 2024, a new, highly automated version of the Shai-Hulud self-replicating worm was discovered targeting the npm (Node.js package manager) supply chain. Attackers injected malicious code into nearly 500 npm packages over three days, successfully exposing credentials and secrets from more than 26,000 open-source repositories hosted on GitHub. Leveraging stolen npm tokens, the malware rapidly compromised packages—including those used by major organizations such as Zapier, ENS Domains, PostHog, and Postman—enabling the creation of malicious files and exfiltration of sensitive data at an unprecedented scale. Researchers noted that these attacks used advanced automation and leveraged the inherent trust of open-source software distribution systems. This incident underscores the growing risk of supply-chain attacks exploiting developer ecosystems and the increased targeting of developer credentials by threat actors. The rapid, automated propagation demonstrates the urgent need for supply-chain security and proactive controls as attacker sophistication and automation continue to escalate across the software ecosystem.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Voice Phishing Attack Exposes Harvard Alumni and Donor Data in 2024 Breach
Higher Education/Acadamia10 months ago

Voice Phishing Attack Exposes Harvard Alumni and Donor Data in 2024 Breach

In June 2024, Harvard University disclosed a significant data breach after attackers compromised its Alumni Affairs and Development systems via a sophisticated voice phishing (vishing) attack. By deceiving university staff over the phone, the threat actors gained unauthorized access to sensitive databases containing personal information of students, alumni, donors, faculty, and staff. Although there is no evidence of misuse so far, the exposed data may include contact information, date of birth, employment and education history, and donation records, potentially increasing victims’ risk of targeted phishing and fraud. The breach has raised serious concerns about the vulnerabilities introduced by social engineering and legacy authentication systems among educational institutions. This incident is particularly relevant given the surge in identity-based and social engineering attacks across higher education, where attackers exploit human trust as the weakest link. Regulatory scrutiny and the growing value of academic donor databases place further pressure on institutions to adopt modern defenses, like multi-factor authentication and advanced detection capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Shai-Hulud Malware Infects 500+ NPM Packages: Supply-Chain Security Risks in 2024
Computer Software/Engineering10 months ago

Shai-Hulud Malware Infects 500+ NPM Packages: Supply-Chain Security Risks in 2024

In early 2024, a large-scale supply-chain attack was uncovered involving the Shai-Hulud malware, which trojanized over 500 npm packages, including popular libraries such as Zapier, ENS Domains, PostHog, and Postman. Attackers managed to infiltrate the npm registry, publishing compromised versions that, when installed, exfiltrated sensitive credentials and environment secrets—often leaking them publicly on GitHub Gists. This incident exposed development teams and software supply chains globally to credential theft and potentially destructive lateral attacks, impacting both organizations unknowingly using these packages and the open-source ecosystem at large. This incident highlights an accelerating trend in sophisticated supply-chain intrusions, where threat actors target code distribution channels such as npm to maximize reach and impact. It underscores the urgent need for better controls around software dependencies, identity management, and monitoring of open-source components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ClickFix 2024: New Attack Exploits Fake Windows Update Screens to Spread Malware
Financial Services10 months ago

ClickFix 2024: New Attack Exploits Fake Windows Update Screens to Spread Malware

In mid-2024, cybersecurity researchers identified a new ClickFix attack campaign where threat actors leveraged social engineering to trick users with a realistic, full-screen Windows Update animation within their browsers. Malicious code was cleverly hidden inside images on these spoofed update screens, evading many conventional security controls. Victims were lured to these pages via phishing links, leading to inadvertent malware installation, allowing attackers to potentially exfiltrate credentials, establish persistent remote access, or deploy additional payloads. Businesses across various industries may face operational risks such as lateral movement, data exfiltration, or ransomware threats as a result. This incident is particularly relevant as adversaries continue to refine social engineering and live-off-the-land tactics. The increasing sophistication of browser-based deception demonstrates the ongoing evolution of phishing and malware delivery methods, requiring organizations to continuously adapt their awareness training and layered defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports