Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Palo Alto GlobalProtect VPN Vulnerability (CVE-2024-3400): Global Exploitation in 2024
In September 2024, cybersecurity observers detected a surge in malicious internet scans targeting Palo Alto Networks GlobalProtect gateways vulnerable to CVE-2024-3400. Threat actors exploited an authentication validation flaw, enabling unauthenticated attackers to manipulate session IDs and upload arbitrary files to the server. Initial activity was observed from IP 141.98.82.26, executing file upload and retrieval attempts against honeypots. While early-stage attacks focused on validating exploitability, successful exploitation of this flaw could lead to remote code execution, exposing enterprise networks protected by GlobalProtect to compromise, lateral movement, and potential data breaches. This incident is significant as CVE-2024-3400 rapidly attracted widespread exploitation attempts, with proof-of-concept code and automated scanning observed in the wild. The event underscores the criticality of timely appliance patching and the inherent risk posed by remotely accessible VPN infrastructure in enterprise environments.
8 months ago
Kill Chain
Battering RAM: $50 Hardware Attack Breaks Intel & AMD Cloud Defenses
In October 2025, researchers from KU Leuven and the University of Birmingham unveiled a significant vulnerability dubbed "Battering RAM" affecting both Intel and AMD cloud processor architectures. By inserting a $50 hardware interposer into the memory bus, attackers demonstrated the ability to bypass state-of-the-art cloud security mechanisms. This approach allowed them to intercept, manipulate, and extract both encrypted and unencrypted in-memory data flows intended to remain protected by hardware and virtualization-layer defenses. The attack's stealth and low cost highlight the practical risk to multi-tenant and cloud environments relying on trusted chipset-based security. The Battering RAM disclosure comes amid growing concerns around hardware-level threats capable of undermining software-managed frameworks, especially in multi-cloud and highly regulated sectors. This incident underscores the need for enhanced hardware threat modeling, rapid detection capabilities, and updated compliance guidance tailored to physical vector risks.
8 months ago
Kill Chain
Apple Rushes Security Fix for Critical FontParser Vulnerability (CVE-2025-43400)
In September 2025, Apple released urgent security updates for iOS, iPadOS, macOS, and visionOS to address CVE-2025-43400—a vulnerability in the FontParser component allowing maliciously crafted fonts to trigger app termination or corrupt process memory. This flaw affects recent and some older OS versions, with Apple pushing out rapid patches to prevent potential exploitation. As of release, there is no evidence of active attacks or remote code execution stemming from this bug, but the vulnerability represents a serious risk due to the widespread use of affected products and the low-complexity of font-based exploits. This incident highlights how even routine OS updates can carry vital security fixes against emerging threats. With font parsing bugs being favored by both criminals and spyware operators in recent years, broad and proactive patching remains essential, especially as quick-moving threat actors seek early exploit opportunities.
8 months ago
Kill Chain
IoT Devices in the Crosshairs: The 2024 Admin Cookie Exploitation Wave
In September 2024, widespread exploitation of IoT devices was observed, leveraging insecure session cookies and weak access control. Attackers were able to escalate privileges or bypass authentication entirely by modifying HTTP cookies such as 'user=admin', 'uid=1', or similar session tokens on devices including TBK DVRs, LB-LINK routers, Tenda access points, and biometric access systems. The method often enabled the execution of OS commands or remote code, with threat actors targeting default credentials and under-protected web interfaces for persistence and lateral movement. Impact included unauthorized system changes, potential data exfiltration, and compromise across IoT and networking infrastructure in both consumer and enterprise environments. This incident highlights an ongoing trend: attackers increasingly exploit weak authentication and session management in IoT devices, which often lack robust patching and monitoring. With regulatory frameworks tightening and IoT expanding into critical sectors, such low-effort but high-impact vulnerabilities are becoming a major concern for organizations seeking to secure their operational technology.
8 months ago
Kill Chain
Akira Ransomware Launches Mass Attack on SonicWall VPNs in 2025
In mid-2025, Akira ransomware operators launched a widespread campaign targeting organizations using SonicWall VPN appliances, exploiting a critical vulnerability (CVE-2024-40766) in SonicOS firmware. Attackers achieved initial access through malicious SSL VPN logins, sometimes even bypassing one-time password (OTP) multi-factor authentication controls. Following a successful breach, the attackers conducted rapid port scanning and lateral movement via Impacket SMB activity before deploying Akira ransomware, impacting organizations across various sectors. Despite firmware updates and password resets, compromised credentials persisted, leaving several devices exposed, and the campaign has continued to escalate into late September 2025. This incident illustrates the ongoing evolution and sophistication of ransomware campaigns exploiting network infrastructure vulnerabilities and underscores the urgency of proactive credential management, privileged access monitoring, and swift patch adoption. It exemplifies growing attacks abusing VPNs and MFA, requiring organizations to revisit zero trust and layered defense measures.
8 months ago
Kill Chain
Malicious MCP Server Abuses AI Email Automation for Covert Secrets Exfiltration
In June 2024, researchers uncovered a supply-chain attack involving a malicious Managed Communication Platform (MCP) AI server deployed by enterprises for automating routine email tasks, such as password resets, account confirmations, and invoicing. Threat actors subverted the platform to silently exfiltrate sensitive information by routing copies of key emails via BCC fields to attacker-controlled addresses. This tactic enabled attackers to capture credentials, personally identifiable information (PII), and financial data from authentic business processes, making detection extremely challenging and extending the risk across multiple organizations leveraging the affected platform. The incident highlights a growing trend of attackers abusing trusted third-party SaaS and AI service integrations to conduct covert exfiltration at scale. As supply-chain vectors proliferate, organizations face increased pressure to monitor internal communication workflows and enforce egress controls on platform-generated messaging.
8 months ago
Kill Chain
Google Gemini AI Model Vulnerabilities: The 2024 Security Wake-Up Call
In early 2024, significant security and privacy vulnerabilities were discovered across multiple Google Gemini AI models, exposing users and enterprises to attack vectors that could have led to data leakage, privilege escalation, and AI-assisted exploitation. Researchers identified a 'trifecta' of flaws enabling prompt injection, sensitive data exposure, and circumvention of embedded safety controls, highlighting weaknesses in current generative AI guardrails. While no widespread attacker exploitation was confirmed, proof-of-concept attacks demonstrated how these flaws could weaponize Gemini models as an attack surface and vehicle for secondary threats. The disclosure prompted urgent reviews of AI usage and mitigations for enterprise consumers. This incident underscores escalating risks as generative AI platforms become embedded across business workflows. It illustrates the urgent challenge of securing large language models (LLMs) against novel exploitation methods and the rapidly intensifying focus by both attackers and regulators on AI/ML supply chain security.
8 months ago
Kill Chain
Malicious MCP Server Uncovered in 'postmark-mcp' npm Package Supply Chain Breach
In September 2025, cybersecurity researchers identified the first active malicious deployment of a Model Context Protocol (MCP) server, delivered through a compromised open-source npm package called "postmark-mcp." The attacker, masquerading as a legitimate developer, introduced rogue code into the package to stealthily exfiltrate user emails to an adversary-controlled MCP server. The package closely mimicked the official Postmark Labs library, making detection challenging for organizations relying on the trusted supply chain. The incident highlights the growing sophistication and operational impact of supply chain compromise, especially within widely used repositories like npm. This supply chain breach underscores a wider trend of attackers targeting open-source ecosystems to weaponize trusted libraries for data theft and persistent access, driving regulatory scrutiny and risk to software providers and their customers. With the acceleration of software supply chain attacks, organizations face increased pressure to enhance dependency audits and adopt zero trust controls.
8 months ago
Kill Chain
Microsoft Warns: AI-Powered SVG Phishing Campaign Evades Email Security
In September 2025, Microsoft disclosed a sophisticated phishing campaign targeting US-based organizations that leveraged large language models (LLMs) to craft highly obfuscated SVG file payloads. Attackers used these LLM-generated SVG attachments to evade traditional email security filters, employing convincing business terminology and synthetic code structures to deliver malicious links or steal credentials. The campaign demonstrates a notable escalation in phishing tactics, exploiting advancements in AI to automate and disguise attack vectors, with the operational impact ranging from compromised accounts to potential supply chain breaches. This incident exemplifies a new era of phishing attacks empowered by generative AI, underlining the growing urgency for advanced detection capabilities and stricter email security policies. The trend highlights a pivot toward more adaptive, machine-generated threats that traditional tools may be ill-equipped to address.
8 months ago
Kill Chain
EvilAI: Malware Masquerading as AI Tools Targets Global Enterprises in 2025
In September 2025, global organizations became targets of a sophisticated malware campaign in which cybercriminals disguised malicious payloads within seemingly legitimate AI productivity tools and software. Security researchers at Trend Micro identified that attackers leveraged the growing popularity and trust in AI-driven solutions to distribute their malware, affecting companies across Europe, the Americas, and AMEA. Adversaries exploited trusted distribution channels, leveraging convincing phishing and software bundling tactics to achieve initial access, with the primary goal of establishing persistent footholds for future attacks, including lateral movement and data exfiltration. The incident disrupted IT operations, forced incident response, and increased the risk of data theft and regulatory exposure. This breach highlights the rapid evolution of social engineering techniques tied to AI trends, with attackers exploiting user demand for productivity tools as an entry point. It underscores an urgent need for heightened vigilance, zero trust policies, and real-time threat detection in the face of shadow AI and increasingly indistinguishable malicious downloads.
8 months ago
Kill Chain
2025’s Cyber Tsunami: Cisco 0-Day, Record DDoS & Multi-Vector Threats Unleashed
In September 2025, the global cybersecurity landscape faced a convergence of high-profile threats, including a critical Cisco 0-day vulnerability, record-breaking distributed denial-of-service (DDoS) attacks, an emergent LockBit 5.0 ransomware variant, multiple vulnerabilities targeting baseboard management controllers (BMC), and rapid expansion of the ShadowV2 botnet. Adversaries exploited the Cisco 0-day to gain privileged access, launched multi-vector DDoS assaults disrupting online services, compromised server hardware via BMC flaws, and weaponized the new LockBit variant for data extortion and ransomware. The combination of these attacks resulted in widespread operational instability, data breaches, and heightened risk exposure across cloud and on-premises environments. These incidents underscore the rapidly evolving threat landscape, marked by increasingly sophisticated and diverse attack vectors that target infrastructure, software, hardware, and supply chains simultaneously. The convergence of ransomware, DDoS, and zero-day exploitation—often driven by organized cybercriminal groups—signals an urgent need for organizations to adopt layered, zero trust security strategies and accelerate detection and response.
8 months ago
Kill Chain
CISA Expiration: The Looming Risk to U.S. Cyber Threat Intelligence Collaboration
In June 2024, the Cybersecurity Information Sharing Act (CISA) is poised to expire, potentially removing crucial liability protections that allow private and public entities to exchange cyber threat intelligence without fear of legal repercussions. If congressional reauthorization is not enacted, organizations may retreat from collaborative defense, risking increased exposure to sophisticated cyber threats like AI-driven attacks, ransomware, and advanced nation-state intrusions such as the recent Salt Typhoon telecommunications incidents. The expiration signals a return to pre-2015 conditions, where fear of litigation fostered information silos and hindered a unified defensive posture. This situation is particularly urgent given today’s rapidly evolving threat landscape, marked by automated attacks, cloud-scale lateral movement, and the surge of machine-driven identities. The outcome will shape both regulatory priorities and operational risk management for sectors relying on timely, actionable intelligence sharing.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports