Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 241 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2881–2892 / 3497 reports
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
Computer Software/Engineering10 months ago

Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data

In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions
Financial Services10 months ago

GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions

Beginning on November 14, 2025, cybersecurity researchers detected an unprecedented surge in malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN portals worldwide. Over 2.3 million scan sessions were recorded within days, emanating from a diverse array of global IP addresses and employing automated tools to probe for vulnerabilities and gather intelligence on remote-access infrastructure. While no large-scale exploitations or breaches have yet been confirmed, the scanning phase indicates advanced reconnaissance tactics that precede exploitation, raising significant concern for organizations relying on GlobalProtect for secure remote access. This event highlights a sharp escalation in mass automated reconnaissance against widely deployed VPN systems, following recent critical vulnerabilities in VPN technologies and a growing attacker focus on initial access vectors. The trend reinforces the urgency for improved monitoring, swift patching, and modern segmentation controls in remote-access environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
Computer Software/Engineering10 months ago

TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave

In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Global WhatsApp Hack: CTM360 Exposes HackOnChat Social Engineering Campaign
Financial Services10 months ago

Global WhatsApp Hack: CTM360 Exposes HackOnChat Social Engineering Campaign

In late 2025, cybersecurity firm CTM360 revealed 'HackOnChat,' a sophisticated, large-scale social engineering campaign targeting WhatsApp users globally. Threat actors orchestrated the attack via fake authentication portals and impersonation webpages, tricking victims into divulging credentials that enabled account hijacking. The operation weaponized WhatsApp's familiar interface, leveraging psychological manipulation and deception, and resulted in thousands of compromised accounts and malicious URLs. Disruption of user communications and risk of further abuse (such as account-based impersonation or fraud) were observed. This breach underscores the accelerating use of social engineering tactics in messaging platforms, reflecting a surge in identity-based attacks that exploit user trust in familiar interfaces. Security teams are increasingly alert to evolving credential-phishing methods that bypass traditional controls, especially as regulatory scrutiny of digital identity security intensifies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
ShadowRay 2.0 Turns Ray AI Framework Flaw into GPU-Powered Cryptomining Botnet
Information Technology/IT10 months ago

ShadowRay 2.0 Turns Ray AI Framework Flaw into GPU-Powered Cryptomining Botnet

In November 2025, the 'ShadowRay 2.0' campaign was uncovered actively exploiting an unpatched, two-year-old vulnerability in the Ray open-source AI framework. Threat actors leveraged this flaw to compromise cloud-hosted and on-premises Ray clusters equipped with NVIDIA GPUs, deploying a self-spreading botnet targeting large-scale cryptomining. The attackers automated lateral movement within cloud environments and data centers, rapidly enrolling new nodes into the botnet, and using high-performance GPUs for illicit cryptocurrency mining, resulting in significant resource abuse, potential data exposure, and increased operational costs for targets. ShadowRay 2.0 highlights the rising trend of adversaries abusing vulnerable AI/ML infrastructure for financially motivated campaigns. The incident underlines the security risks facing organizations using open-source workloads, as attackers increasingly automate botnet propagation, and reinforces the urgency of addressing software supply chain and east-west traffic security gaps.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
JustAskJacky 2025: AI/ML Exploitation Drives Major User Data Exposure
Financial Services10 months ago

JustAskJacky 2025: AI/ML Exploitation Drives Major User Data Exposure

In November 2025, the AI-driven platform JustAskJacky was compromised, exposing sensitive user prompts and data after adversaries exploited weaknesses in encrypted traffic controls and inadequate egress security. Attackers orchestrated lateral movements across internal AI/ML workloads, leveraging insufficient segmentation and lack of effective visibility to siphon proprietary inputs and outputs through encrypted but poorly-monitored channels. The breach remained undetected for weeks, putting affected businesses and consumers at risk of prompt leakage, IP loss, and possible regulatory infractions in industries reliant on AI automation. This incident underscores a surge in sophisticated AI/ML exploitation techniques and highlights systemic gaps in east-west traffic security, zero trust segmentation, and anomaly detection across multicloud and hybrid environments. As organizations accelerate their adoption of AI-powered platforms, the need for robust compliance and zero trust frameworks has reached critical urgency.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Matrix Push: How Browser Notifications Became a C2 Weapon in 2024
Banking/Mortgage10 months ago

Matrix Push: How Browser Notifications Became a C2 Weapon in 2024

In early 2024, cybersecurity researchers reported that a threat actor group leveraged a new Command and Control tool—dubbed 'Matrix Push'—to hijack web browser notifications as an innovative phishing and persistence mechanism. Attackers delivered malicious payloads through deceptive websites, tricking users into allowing browser notifications. These notifications were abused to send phishing lures and exfiltrate user information, evading traditional network monitoring tools by using trusted browser channels. The campaign allowed remote control and persistent access to compromised endpoints, highlighting a shift toward social engineering at the browser level. Organizations targeted included enterprises in technology, finance, and professional services sectors, resulting in elevated risks of credential theft and lateral movement. This incident is especially notable for exploiting a trusted browser feature in new ways, bypassing established email and endpoint filtering controls. As browser notification-based attacks surge, security teams face increased pressure to adapt controls. The tactics highlight the urgent need for enhanced user awareness and modern segmentation/visibility solutions that can identify and mitigate covert browser-based C2 channels.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025
Construction10 months ago

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

In November 2025, Automated Logic disclosed critical vulnerabilities impacting multiple legacy versions of its WebCTRL Premium Server and related Carrier i-Vu and SiteScan Web products. Reported by researchers Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine, the flaws—CVE-2024-8527 (Open Redirect) and CVE-2024-8528 (Cross-site Scripting)—could allow remote attackers to deceive users into navigating to malicious sites or executing attacker-controlled scripts. These vulnerabilities affect industrial control solutions deployed globally within the Critical Manufacturing sector, potentially enabling credential theft, phishing, or unauthorized access to sensitive building automation environments. This incident underscores the urgent need for timely patching and secure software development in critical infrastructure industries. As web application attacks increase and threat actors target supply chain and operational technology, coordinated disclosures and swift remediation remain vital to reduce risk and comply with tightening regulatory frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks
Health Care / Life Sciences10 months ago

Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks

In November 2025, a critical vulnerability (CVE-2024-3871) was disclosed affecting Emerson's Appleton UPSMON-PRO, a monitoring solution widely deployed in critical infrastructure sectors including manufacturing and healthcare. Security researchers found that remotely sent, specially crafted UDP packets could trigger a stack-based buffer overflow, granting attackers SYSTEM-level privileges and permitting remote code execution on unpatched systems. The product, which reached End of Life status prior to disclosure, is still in use across several organizations, amplifying the impact of the vulnerability on global operational technology environments. This incident underscores a growing pattern of legacy ICS software vulnerabilities being targeted via low-complexity, remote attacks. Increased regulatory scrutiny and the advancing sophistication of attackers elevate the importance of updating unsupported systems and implementing defense-in-depth strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025
Commercial Real Estate10 months ago

iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025

In November 2025, critical vulnerabilities were disclosed affecting iCam365 CCTV camera models P201 and QC021 (versions 43.4.0.0 and prior), allowing unauthorized access to video streams and configuration data via missing authentication controls. CVE-2025-64770 and CVE-2025-62674 enable attackers present on the same network segment to exploit unauthenticated access to ONVIF and RTSP services, potentially exposing sensitive surveillance footage and device configurations across commercial facilities globally. The vulnerabilities were reported by researcher Truong Nguyen Long and published by CISA after vendor non-responsiveness. This exposure highlights the persistent risk of IoT and security camera devices with weak or missing access controls, coinciding with broader trends of exploitation in internet-connected infrastructure. As remote surveillance soars and IoT devices proliferate, such lapses in device security increase the attack surface for organizations across industries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
AI Agents: The New Attack Surface for Network Compromise in 2024
Financial Services10 months ago

AI Agents: The New Attack Surface for Network Compromise in 2024

In early 2024, cybersecurity researchers highlighted a critical weakness in agentic AI systems, demonstrating that malicious actors can subvert autonomous AI agents to alter behavior and compromise entire enterprise networks. By leveraging AI agent hijacking, attackers manipulated goal-seeking models and agent-to-agent communications to bypass security controls, escalate privileges, and move laterally within high-value environments. The incident revealed how the expanding AI/ML attack surface introduces new entry vectors tied to agent autonomy, cloud AI orchestration, and internal east-west traffic, posing operational risk to organizations deploying intelligent automation at scale. This incident underscores the urgent need for AI security frameworks and robust segmentation controls as enterprises accelerate agent and copilot deployments. With rapid adoption of agentic AI, attackers are increasingly exploiting flaws in agent autonomy and communication to orchestrate sophisticated attacks, raising the bar for zero trust and security visibility in multi-cloud environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny
Financial Services10 months ago

Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny

In June 2024, Fortinet disclosed that a second zero-day vulnerability affecting its FortiWeb Web Application Firewall (WAF) products was actively exploited in the wild. Attackers leveraged the undisclosed flaw to bypass security controls and potentially gain unauthorized remote access to customer environments, raising major concerns about the rapidity and transparency of Fortinet's incident response. The breach followed an earlier 2024 WAF zero-day, indicating a worrying escalation in threat actor targeting and sophistication against network-edge defense systems. This incident underscores the increasing prevalence of zero-day attacks against security appliances themselves, a trend accelerated by sophisticated threat actors who seek to exploit both technical weaknesses and delayed vendor responses. Rapid incident disclosure and robust patching are now critical to safeguarding key infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports