Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 246 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2941–2952 / 3497 reports
Fortinet 2025: Chained FortiWeb Flaws Enable Remote Code Execution and Privilege Escalation
Financial Services10 months ago

Fortinet 2025: Chained FortiWeb Flaws Enable Remote Code Execution and Privilege Escalation

In November 2025, Fortinet disclosed two critical vulnerabilities (CVE-2025-64446 and CVE-2025-58034) affecting multiple versions of its FortiWeb web application firewall. Exploited as a chained attack, the first flaw—relative path traversal—enabled unauthenticated attackers to execute administrative commands via crafted HTTP/HTTPS requests, while the second—OS command injection—allowed privilege escalation and execution of unauthorized code by authenticated users. Security agencies confirmed observed exploitation in the wild, with potential impact including network compromise, lateral movement, and loss of control over critical web applications. Fortinet and CISA urged immediate upgrades and review of affected deployments. This incident underscores a broader trend of adversaries targeting internet-facing security appliances as entry points, chaining vulnerabilities for deeper network access. The rapid inclusion of these CVEs in CISA’s Known Exploited Vulnerabilities catalog reflects the elevated urgency and broader risk to organizations across sectors relying on web application firewalls as a key security control.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Fortinet FortiWeb’s 2025 Path Traversal Attack: What You Need to Know
Government Administration10 months ago

Fortinet FortiWeb’s 2025 Path Traversal Attack: What You Need to Know

In November 2025, Fortinet's FortiWeb product was found vulnerable to an actively exploited path traversal flaw, designated as CVE-2025-64446. Malicious actors leveraged this vulnerability to bypass web application security measures, gaining unauthorized access to sensitive files on the system. As a result, attackers could exfiltrate data and potentially escalate privileges, thereby putting organizations at significant risk of broader compromise. The flaw became a critical concern for organizations using FortiWeb, prompting immediate remediation actions to protect against ongoing attacks targeting US federal and private sector networks. The incident highlights the growing trend of sophisticated exploitation of web application devices by threat actors. A surge in path traversal and similar vulnerabilities in critical infrastructure underscores the need for robust, proactive vulnerability management as required by directives like CISA BOD 22-01 and made clear by its inclusion in the Known Exploited Vulnerabilities Catalog.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Matryoshka Malware: How Attackers hide Exploits in Nested Office Files (2025)
Financial Services10 months ago

Matryoshka Malware: How Attackers hide Exploits in Nested Office Files (2025)

In November 2025, security researchers identified a novel malware delivery technique leveraging Microsoft Office documents mimicking Russian Matryoshka dolls. Attackers embedded a weaponized RTF file exploiting CVE-2017-11882 inside an OOXML Word document, circumventing Microsoft's restrictions on automatic macro execution. Upon opening, the document triggers shellcode that writes a malicious DLL to the user's local Temp directory, which is then executed using an obfuscated command to evade detection. The attack demonstrates advanced evasion tactics, potentially linked to info-stealers such as FormBook, complicating detection and response efforts for organizations relying on traditional file-type controls. This incident highlights the ongoing relevance of document-based exploitation despite reduced macro attacks, as threat actors adopt creative nesting techniques. Security teams must adapt to evolving delivery mechanisms that circumvent recent platform protections, making layered defenses and behavioral detection increasingly essential.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
FBI Flags Akira Ransomware as Top Threat to US Critical Infrastructure in 2024
Health Care / Life Sciences10 months ago

FBI Flags Akira Ransomware as Top Threat to US Critical Infrastructure in 2024

In September 2024, federal cyber authorities, including the FBI and CISA, issued a joint advisory detailing the significant threat posed by the Akira ransomware group. First identified in March 2023, Akira employs double-extortion tactics—stealing sensitive data before encrypting systems—to pressure victims for ransom. The group is associated with additional threat actors and has links to the former Conti operation. Akira has accumulated over $244 million in illicit proceeds by targeting small and medium-sized businesses, impacting sectors such as manufacturing, education, healthcare, IT, finance, and agriculture. The group leverages known vulnerabilities in critical infrastructure software, exploits stolen credentials, and uses remote access tools to compromise organizations, often exfiltrating data in just over two hours. The FBI considers Akira among its top five most consequential ransomware variants, reflecting a broader trend of increasingly sophisticated, fast-moving, and costly ransomware attacks. Recent activity highlights the group’s adaptability and operational security, reinforcing the urgent need for organizations to harden defenses as ransomware tactics evolve.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
2024 Uhale Android Photo Frame Breach: Supply Chain Malware Risk
Consumer Electronics10 months ago

2024 Uhale Android Photo Frame Breach: Supply Chain Malware Risk

In mid-2024, security researchers discovered that popular Uhale-branded Android-based digital photo frames were shipping with critical security flaws, including a supply chain compromise whereby the devices automatically downloaded and executed malware upon boot. The attack exploited insecure system components and unauthorized code injection, allowing threat actors to remotely install and run arbitrary malware. As a result, affected users faced risks ranging from credential theft and device hijacking to involuntary participation in botnets, with downstream exposure to broader enterprise or home networks if connected. This incident comes amid a broader surge in supply chain attacks targeting IoT and smart devices, with attackers leveraging manufacturer or third-party vulnerabilities to pre-install malware before devices reach consumers. The event highlights the growing regulatory and operational scrutiny of supply chain security, emphasizing the urgent need for enhanced vendor risk management and enterprise device segmentation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags WatchGuard Firebox Vulnerability: Network Security on High Alert in 2024
Government Administration10 months ago

CISA Flags WatchGuard Firebox Vulnerability: Network Security on High Alert in 2024

In April 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to all federal agencies to patch a critical vulnerability in WatchGuard Firebox firewalls. This flaw, actively exploited in the wild, allowed remote attackers to gain code execution privileges on unpatched devices, placing affected organizations at risk of network compromise. Exploitation was achieved through maliciously crafted requests, providing attackers with unauthorized access, persistence, and the potential to pivot laterally within victim environments. The incident prompted the federal government and private sector organizations to accelerate patch deployment to mitigate ongoing attacks. This breach underscores the persistent threat to network appliances and the importance of rapid vulnerability management as attackers increasingly target edge devices for initial access. The current trend reflects heightened regulatory scrutiny and an evolving attack surface driven by both state and financially motivated threat actors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Police Disrupts Global Rhadamanthys, VenomRAT & Elysium Malware Servers in Landmark 2024 Operation
Financial Services10 months ago

Police Disrupts Global Rhadamanthys, VenomRAT & Elysium Malware Servers in Landmark 2024 Operation

In May 2024, a coordinated international operation involving law enforcement agencies from nine countries dismantled 1,025 servers associated with the Rhadamanthys infostealer, VenomRAT, and Elysium botnet malware operations. The infrastructure takedown was part of Operation Endgame, which targeted malware botnets used to steal data, deliver ransomware, and facilitate cyberattacks globally. By disrupting these networks, authorities severely impaired the threat actors' ability to conduct ongoing credential, financial, and personal data theft campaigns against businesses and individuals across multiple regions. This incident highlights the escalating efforts among global law enforcement to target and disable cybercriminal infrastructure at scale. The takedown reflects a trend towards greater intelligence-sharing and direct action, signaling that even complex, distributed botnet operations can be disrupted through multinational cooperation.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Alert: Active Exploitation of Cisco ASA & Firepower Devices in 2024
Government Administration10 months ago

CISA Alert: Active Exploitation of Cisco ASA & Firepower Devices in 2024

In June 2024, CISA issued an urgent alert to federal agencies following the discovery of active exploitation of two critical vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices. Threat actors leveraged these flaws to bypass authentication and remotely execute code, potentially enabling lateral movement and unauthorized network access. Several government and enterprise environments were left exposed due to unpatched systems, raising significant risk to sensitive operations and regulated data. This incident underscores the growing sophistication of cybercriminals targeting network infrastructure, particularly edge devices, and highlights the urgent need for rapid patch management and network segmentation as threat vectors continually evolve.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kerberoasting in 2025: Service Account Risks and Zero Trust Imperatives
Financial Services10 months ago

Kerberoasting in 2025: Service Account Risks and Zero Trust Imperatives

In early 2025, a significant cyber incident occurred in which attackers leveraged Kerberoasting techniques to compromise Active Directory (AD) environments. Threat actors exploited weakly protected service accounts to request service tickets, subsequently brute-forcing their encrypted credentials offline. This attack method enabled them to escalate privileges and potentially gain domain administrator access, often without triggering security alerts. The intrusion highlighted shortcomings in credential hygiene, detection capabilities, and adherence to modern encryption standards within corporate IT infrastructures. Operational impacts included increased risk of lateral movement, data exfiltration, and potential business disruption had the attackers established persistent access. Kerberoasting attacks have become more prevalent due to their stealthy nature and the widespread reliance on legacy authentication protocols. As organizations accelerate digital transformation and adopt zero trust models, identity-based threats like these place added emphasis on proactive credential management, monitoring, and compliance with encryption regulations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Akira Ransomware Targets Nutanix AHV Linux VMs: 2024 Attack Analysis
Health Care / Life Sciences10 months ago

Akira Ransomware Targets Nutanix AHV Linux VMs: 2024 Attack Analysis

In early 2024, threat actors associated with the Akira ransomware group expanded their operations to target Nutanix AHV virtual machines (VMs) running on Linux, according to alerts from CISA and other cybersecurity agencies. By leveraging compromised credentials or exploiting vulnerabilities, attackers gained access to enterprise infrastructure and deployed a Linux-based Akira encryptor capable of encrypting entire Nutanix VM environments. This strategy disrupted critical workloads and led to significant operational downtime, as well as potential data loss and extortion threats for affected organizations. This incident underscores a trend of ransomware groups shifting focus toward virtualization platforms and cloud infrastructure, extending risks beyond traditional endpoints. The Akira campaign highlights the growing sophistication of ransomware TTPs and the urgent need for robust segmentation and lateral movement controls within virtualized environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
IndonesianFoods npm Worm Floods Registry with 100,000 Packages in Major Supply Chain Incident
Computer Software/Engineering10 months ago

IndonesianFoods npm Worm Floods Registry with 100,000 Packages in Major Supply Chain Incident

In June 2024, the npm package ecosystem was targeted by a self-propagating malware dubbed the 'IndonesianFoods' worm. The worm exploited npm’s open publishing model, rapidly flooding the registry with nearly 100,000 malicious, junk packages at a rate of one every seven seconds. Working autonomously, the malware replicated itself using pre-programmed scripts, creating an unprecedented scale of package spam, which overwhelmed the registry, threatened package discovery, and disrupted normal operations for developers worldwide. No evidence so far points to direct compromise of sensitive data or targeted attacks on organizations, but the overwhelming volume affected the trust and stability of the npm supply chain platform. This event spotlights the vulnerability of open-source ecosystems to automated spam and self-replicating threats, underscoring the growing risk in software supply chains from both criminal and experimental actors. The surge in npm-focused attacks amplifies calls for stronger package validation, improved security automation, and supply-chain controls industry-wide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Flood of Fake npm Packages Reveals Growing Supply Chain Attack Risk
Computer Software/Engineering10 months ago

Flood of Fake npm Packages Reveals Growing Supply Chain Attack Risk

In early 2024, a financially-motivated threat actor orchestrated a large-scale spam campaign that flooded the npm package registry with over 67,000 fake packages. By systematically publishing malicious and junk modules, the actor exploited npm’s open nature, allowing the fake packages to persist on the platform for nearly two years. These packages, often uploaded with auto-generated names and code, increased risks for developers by inflating dependency confusion attack surfaces and potentially delivering malware through the software supply chain. The incident underscored ongoing challenges in detecting and mitigating large-scale abuse within open-source ecosystems, disrupting trust and reliability for countless organizations relying on npm. This attack is emblematic of a wider trend in software supply-chain targeting, with threat actors increasingly exploiting public repositories to propagate malicious code or disrupt developer workflows. As software supply chains remain a critical risk focal point, organizations face mounting regulatory scrutiny and require robust governance and anomaly detection controls to safeguard development environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports