Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Urgent: DrayTek Vigor Router RCE Vulnerability (CVE-2025-10547) Exposes SMB Networks
In October 2025, DrayTek disclosed a critical remote code execution vulnerability (CVE-2025-10547) impacting multiple Vigor router models, commonly used by small to medium businesses. The flaw allows unauthenticated attackers to remotely execute arbitrary code by sending specially crafted HTTP or HTTPS requests to the router's Web User Interface (WebUI). Triggered by an uninitialized stack value that facilitates arbitrary memory operations, the vulnerability could lead to full system compromise, crash, or remote takeover if exploited. DrayTek confirmed the issue following responsible disclosure and provided urgent firmware updates for affected devices. This incident exemplifies the rising risks posed by infrastructure vulnerabilities in network devices widely deployed in business environments. As attackers increasingly target edge and remote-management interfaces, proactive patch management has become paramount for organizations seeking to mitigate evolving threats and comply with stricter cybersecurity standards.
8 months ago
Kill Chain
Cl0p Ransomware Targets Oracle E-Business Suite: 2025 Executive Extortion Wave Uncovered
In October 2025, Google Mandiant and the Google Threat Intelligence Group reported a new extortion campaign targeting organizations using Oracle E-Business Suite. The campaign, believed to be orchestrated by the financially motivated Cl0p ransomware group, involved the distribution of extortion emails to C-level executives, claiming theft of sensitive business data. Attackers leveraged weaknesses in Oracle’s environment to exfiltrate confidential information, applying pressure for payment through credible threats of public disclosure and operational disruption. This incident highlights the evolving nature of ransomware tactics towards high-value enterprise applications and direct executive outreach. This case demonstrates the increasing trend of threat actors focusing on business-critical cloud and ERP platforms, not only for data theft but also to maximize ransom leverage. Sophisticated phishing, lateral movement, and exploitation of complex SaaS ecosystems make such attacks especially challenging to detect and contain.
8 months ago
Kill Chain
Multi-Vector Cyber Assault 2025: CarPlay, Cloud SQL, & iCloud Under Attack
In October 2025, coordinated threat actors launched a multi-vector attack campaign leveraging a critical CarPlay exploit, BYOVD (Bring Your Own Vulnerable Driver) tactics, SQL server compromise for covert command-and-control (C2), and targeted backdoor deployments against iCloud accounts. Attackers exploited unpatched vulnerabilities across automotive infotainment systems, enterprise firewalls, and cloud environments, enabling lateral movement and persistent access. The campaign demonstrated a sophisticated blend of supply chain targeting, abuse of trusted encryption protocols, malicious browser extension injection, and data exfiltration at scale. Impacted organizations faced substantial operational disruption, data loss, and the risk of regulatory penalties due to exposure of sensitive customer information and business-critical systems. This incident underscores the rapid evolution of attacker tradecraft, particularly in hybrid infrastructures and connected vehicles. The convergence of cloud, automotive, and critical business services in a single campaign highlights the increasing necessity for comprehensive, real-time security that spans east-west traffic, encrypted channels, and multi-cloud platforms.
8 months ago
Kill Chain
Malicious PyPI Package 'soopsocks' Infects 2,653 Systems in Supply-Chain Breach
In October 2025, security researchers discovered a malicious Python package named "soopsocks" on the official Python Package Index (PyPI) repository, which was designed to masquerade as a legitimate SOCKS5 proxy tool while covertly delivering backdoor functionalities to affected Windows machines. Attackers used this supply-chain vector to reach unsuspecting developers and organizations, resulting in 2,653 downloads before the package was taken down by PyPI administrators. The malware enabled attackers to deploy additional payloads, potentially leading to data exfiltration and further system compromise across multiple organizations. This incident exemplifies the persistent risk of open-source ecosystem attacks, as threat actors increasingly target software supply chains and code repositories. It highlights the urgent need for organizations to harden software development pipelines and monitor third-party dependencies for tampering or malicious behavior.
8 months ago
Kill Chain
Red Hat's 2024 GitLab Breach: Supply Chain Risks and the Rise of Crimson Collective
In September 2024, Red Hat disclosed a breach of its self-managed GitLab instance used by its Consulting services, following claims by the Crimson Collective ransomware group of compromising over 28,000 private repositories. The attackers allegedly exfiltrated software source code and Customer Engagement Reports (CERs), which may contain network details, configuration data, and sensitive credentials. Red Hat initiated remediation steps and assured that its primary software supply chain and core products were not impacted. Belgian authorities warned of potential high-risk exposure for organizations with ties to Red Hat Consulting. This incident underscores a growing trend of supply chain attacks targeting private code repositories and related assets, especially in environments where critical infrastructure and third-party integrations are involved. As ransomware groups pivot to extortion and supply chain vectors, organizations must urgently review their repository and credential management, even on self-managed systems.
8 months ago
Kill Chain
Oracle 2025: Clop Ransomware Group Launches Extortion Campaign Against E-Business Suite Clients
In late September 2025, Oracle E-Business Suite customers were subjected to a wave of targeted extortion emails reportedly sent by threat actors aligned with the Clop ransomware group. The campaign leveraged hundreds of compromised legitimate third-party accounts to send messages claiming theft of customer data from Oracle environments. While Oracle confirmed the outreach and ongoing investigations, it did not specify which vulnerabilities were exploited nor confirm any customer data breach. Multiple Oracle E-Business Suite vulnerabilities, including remotely exploitable flaws, had been patched in July 2025, but ongoing research has yet to verify attack details or data loss. This incident is emblematic of the growing sophistication of financially motivated ransomware groups, who now often use large-scale phishing and extortion campaigns before confirming a breach. The campaign highlights increasing pressure on organizations to patch critical software rapidly and maintain heightened vigilance against social engineering, especially as adversaries leverage supply chain vectors and undermine trust with third-party compromise.
8 months ago
Kill Chain
How North Korean IT Workers Infiltrated Global Businesses: 2025 Insider Threat Surge
Between 2021 and mid-2025, North Korean nationals covertly infiltrated thousands of businesses worldwide by posing as legitimate remote IT and finance workers. According to Okta and other cyber threat intelligence sources, over 130 unique identities were linked to North Korean operatives who participated in more than 6,500 job interviews across roughly 5,000 companies, affecting industries from technology and finance to healthcare and manufacturing. The scheme enabled the North Korean regime to launder payments in violation of international sanctions, while threat actors refined methods to evade common screening controls and exploit global hiring pipelines. High volumes of applications, especially in remote roles, allowed these operatives to bypass national and enterprise-level defenses, embedding deeper into victim organizations’ critical workflows and data environments. The global expansion and sophistication of North Korea’s IT worker operation underscore a dangerous evolution in cyber-enabled insider threats and economic espionage. With a 220% increase in detected North Korean IT worker activity year-over-year, businesses worldwide now face heightened risk regardless of geography or sector, making identity vetting and remote work controls a top security priority.
8 months ago
Kill Chain
Adobe Analytics 2025 Bug Exposes Cross-Tenant Tracking Data
In September 2025, an ingestion bug in Adobe Analytics caused cross-tenant data exposure, allowing customer tracking data from some organizations to appear in the analytics reports of others for nearly a day. The incident began on September 17 due to a performance optimization update that led to incorrect data values surfacing in Analysis Workspace reports. Approximately 3-5% of collected data—across Data Feeds, Live Stream, and scheduled reports—was impacted, with some fields being overwritten by data from other tenants. Adobe promptly reverted the change on September 18 and undertook remediation to cleanse datasets, advising customers to purge affected data from systems and backups to prevent further exposure. This incident underscores the risk posed by inadvertent data exposure within multi-tenant SaaS platforms and the criticality of robust data segregation and validation controls. With regulatory scrutiny over data privacy at an all-time high, such events illustrate how operational changes, even absent malicious intent, can have significant compliance and business ramifications for all affected customers.
8 months ago
Kill Chain
2025 Red Hat OpenShift AI Vulnerability Exposes Hybrid Cloud to Full Takeover
In October 2025, a critical privilege escalation vulnerability was disclosed in Red Hat OpenShift AI, a popular platform for managing AI workloads across hybrid cloud infrastructures. The flaw allowed attackers to obtain elevated permissions and, under certain conditions, seize full control of affected environments. Security researchers identified that threat actors could exploit weak internal segmentation and misconfigurations within the AI lifecycle management layers, resulting in potential unauthorized lateral movement and broad operational impact across connected workloads. Red Hat promptly released advisories and patches, but organizations running unpatched versions remain at risk of infrastructure takeover and sensitive data exposure. This incident comes amid a surge in attacks targeting AI infrastructure and hybrid cloud environments, as adversaries increasingly exploit complex, interconnected platforms. The breach highlights the escalating risk posed by privilege escalation flaws in widely adopted enterprise AI solutions and underscores the urgent need for rigorous segmentation, threat detection, and rapid patch cycles.
8 months ago
Kill Chain
Wiretap Unveiled: DDR4 Side-Channel Attack Extracts Intel SGX ECDSA Keys in 2025
In October 2025, cybersecurity researchers from Georgia Institute of Technology and Purdue University disclosed a novel hardware-based attack that compromises Intel SGX enclaves by exploiting the DDR4 memory bus. By physically placing a wiretap interposer on the memory channel, the attackers were able to observe and ultimately extract ECDSA private keys used for remote attestation, undermining the core protection mechanisms of Intel’s SGX. This passive attack method does not require malware on the target, posing risk for highly sensitive operational environments and organizations reliant on enclave-based security. This incident underscores the growing sophistication of hardware side-channel research and the urgent need to assess trust boundaries in server environments. With critical infrastructure and cloud offerings often relying on SGX for confidential computing, organizations must scrutinize physical and hardware-layer exposures amid a surge of advanced hardware attack demonstrations.
8 months ago
Kill Chain
OneLogin 2025: OIDC/API Key Flaw Exposes Client Secrets to Attackers
In October 2025, a critical security vulnerability (CVE-2025-59363, CVSS 7.7) was disclosed in the One Identity OneLogin IAM platform. The flaw allowed threat actors to use compromised or exposed API keys to retrieve sensitive OpenID Connect (OIDC) application client secrets. Attackers exploiting this vulnerability could potentially impersonate trusted applications, resulting in unauthorized access to protected enterprise resources and disruption of identity-based authentication flows. OneLogin responded with a patch following public disclosure, but the exposure window placed numerous organizations at risk of credential theft and downstream compromise. This incident highlights persistent risks in identity and access management platforms, especially around API security and secret handling. Recent trends show attackers increasingly targeting IAM tools and exploiting weak OIDC/OAuth implementations, making robust zero trust segmentation, continuous threat monitoring, and compliance with established frameworks more critical than ever.
8 months ago
Kill Chain
Chinese APT Group Abuses VMware Privilege Escalation Flaw Throughout 2023
In 2023, sophisticated threat actors attributed to China exploited a previously unknown privilege-escalation vulnerability in VMware platforms for nearly a year before its discovery. Attackers leveraged this flaw, which appeared benign, to gain persistent and stealthy access to targeted virtual infrastructure. Their methods enabled lateral movement, data gathering, and privileged actions within highly segmented data center and cloud environments, affecting a broad range of organizations relying on virtualization for critical workloads. The long-term nature of the operation underscores challenges in detecting nation-state activity exploiting zero-day and privilege-related weaknesses. This incident highlights a broader escalation in advanced persistent threat (APT) campaigns targeting cloud and virtualization layers. As attackers increasingly exploit such integral software stacks with subtle techniques, organizations must reevaluate network segmentation, privilege management, and continuous monitoring to remain resilient.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports