Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 25 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 289–300 / 3490 reports
Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls
Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls
Banking/Mortgage1 month ago

Android 17 Advanced Protection Tackles Mobile Malware Through Accessibility Service Controls

Google announced new security measures in Android 17 that restrict AccessibilityService API access to verified applications when Advanced Protection is enabled, addressing widespread abuse by banking trojans and spyware. The Android AccessibilityService API, designed to assist users with disabilities, has been exploited by malicious actors to perform unauthorized fund transfers, log keystrokes, and steal sensitive data without requiring root access. This restriction represents a significant security enhancement alongside other Android 17 features including intrusion logging, USB protection, and enhanced authentication controls. This development highlights the ongoing evolution of mobile security threats where legitimate accessibility features become weaponized attack vectors. As financial malware and sophisticated spyware increasingly target mobile platforms, platform-level security controls become critical for protecting users from social engineering attacks that abuse system-level permissions.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft
Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft
Computer/Network Security1 month ago

Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft

The Meari IoT Cloud Platform OpenAPI Service contains critical authorization flaws (CVE-2026-101104 and CVE-2026-96613) that allow authenticated users to manipulate device configurations and access sensitive device data without proper ownership verification. These vulnerabilities expose device credentials, owner details, network data, and telemetry information across all versions of the platform. Despite CISA's coordination attempts, Meari has not responded with remediation plans, leaving millions of IoT devices worldwide potentially vulnerable to unauthorized access and manipulation. This incident highlights the growing security challenges in IoT cloud platforms as threat actors increasingly target connected device ecosystems to establish persistence, steal credentials, and pivot into broader network infrastructures through compromised IoT devices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CVE-2026-93616: The Check Point Management Server Vulnerability That Bypasses All Security
CVE-2026-93616: The Check Point Management Server Vulnerability That Bypasses All Security
Financial Services1 month ago

CVE-2026-93616: The Check Point Management Server Vulnerability That Bypasses All Security

CVE-2026-93616 is a critical unauthenticated remote code execution vulnerability affecting Check Point Security Management and Multi-Domain Management servers. Scored 9.8 and actively exploited in the wild, the flaw allows attackers to gain root access through TCP port 19009 without authentication. The vulnerability combines directory traversal, arbitrary file upload, and authentication bypass to achieve complete system compromise. Bishop Fox researchers successfully demonstrated end-to-end exploitation against unpatched R81.10 and R82.10 systems, confirming root-level access to the management infrastructure that controls firewall policies and certificate authorities. This incident highlights the critical importance of securing network management infrastructure as threat actors increasingly target centralized control systems. With Check Point being a major enterprise firewall vendor, compromised management servers could provide attackers with unprecedented visibility and control over organizational network security policies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
KillSec Takedown: How Operation KillSwitch Dismantled a Teen-Led Ransomware Empire
KillSec Takedown: How Operation KillSwitch Dismantled a Teen-Led Ransomware Empire
Health Care / Life Sciences1 month ago

KillSec Takedown: How Operation KillSwitch Dismantled a Teen-Led Ransomware Empire

In January 2025, international law enforcement conducted "Operation KillSwitch," arresting three members of the KillSec data extortion group, including its alleged 16-year-old leader. The cybercrime organization, primarily operated by teenagers, successfully compromised approximately 500 organizations since 2024 through exploitation of security vulnerabilities to steal sensitive data for ransom demands. Authorities seized the group's infrastructure, including their data leak site and over 110 terabytes of stolen data, while conducting coordinated raids across multiple countries. The operation represents a significant disruption to one of the most active youth-led ransomware groups targeting organizations globally. This incident highlights the growing trend of sophisticated ransomware operations being conducted by increasingly younger threat actors, demonstrating how cybercriminal enterprises are recruiting and organizing minors to execute complex multi-stage attacks against critical infrastructure and businesses worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform
Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform
Financial Services1 month ago

Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform

In October 2026, Kiteworks released security patches addressing 126 vulnerabilities, including CVE-2026-54154, a maximum-severity code injection flaw in their Email Protection Gateway (EPG). This critical vulnerability allowed unauthenticated remote attackers to achieve arbitrary code execution and full administrative control through a chain of path traversal, code injection, and missing authentication flaws. The vulnerability was discovered through Kiteworks' bug bounty program and prompted the company to issue an emergency advisory urging customers to shut down their servers as a precautionary measure until patches could be deployed. This incident highlights the growing sophistication of code injection attacks targeting enterprise file-sharing and email security platforms. With nearly 400 Kiteworks instances exposed on the internet and over 100 million end-users potentially affected, the vulnerability demonstrates how critical infrastructure components remain prime targets for attackers seeking to compromise corporate communications and data transfer systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation KillSwitch: How International Law Enforcement Dismantled a Teen-Led Ransomware Empire
Financial Services1 month ago

Operation KillSwitch: How International Law Enforcement Dismantled a Teen-Led Ransomware Empire

In September 2026, international law enforcement's Operation KillSwitch dismantled the KillSec ransomware gang, arresting three suspects and identifying a 16-year-old as the group's alleged administrator. The coordinated action involving ten countries seized the gang's dark web leak site, five servers containing 110 terabytes of stolen data, and disrupted operations responsible for approximately 500 successful attacks worldwide since 2024. KillSec exploited software vulnerabilities and poorly secured edge devices to breach corporate systems, steal sensitive data, and extort victims through their data leak site, receiving substantial ransom payments. This takedown highlights the growing trend of younger cybercriminals leading sophisticated ransomware operations and demonstrates how international cooperation can effectively disrupt modern ransomware-as-a-service ecosystems. The gang's use of artificial intelligence to build infrastructure and identify victims represents an emerging threat vector that organizations must prepare to defend against.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks
Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks
Financial Services1 month ago

Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks

In October 2026, Fortinet disclosed CVE-2026-104286, a critical path traversal vulnerability in FortiMail with a CVSS score of 9.8. The flaw allows unauthenticated attackers to write arbitrary files on vulnerable systems through crafted HTTP requests, affecting FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Attackers actively exploited this zero-day to deploy malicious libraries, modify system binaries, and establish data exfiltration channels to remote servers at compromised IP addresses. This incident highlights the growing trend of attackers targeting email security appliances as high-value entry points into enterprise networks, particularly exploiting path traversal vulnerabilities that bypass authentication mechanisms and enable immediate system-level access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader
International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader
Financial Services1 month ago

International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader

In September 2026, international law enforcement arrested three individuals including a 16-year-old Spanish teen suspected of leading the KillSec ransomware-as-a-service operation. The coordinated operation involved police from Spain, Germany, UK, and Romania, resulting in the seizure of KillSec's leak site, servers, and over 110 terabytes of stolen data. KillSec exploited software vulnerabilities and cloud storage misconfigurations to breach approximately 1,000 organizations worldwide, with 500 confirmed successful attacks causing substantial financial damage including one incident in Catalonia worth nearly €1 million. This arrest highlights the growing sophistication of young cybercriminals operating ransomware-as-a-service models and the increasing effectiveness of international law enforcement cooperation in dismantling major ransomware operations that threaten critical infrastructure globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026
Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026
Computer Software/Engineering1 month ago

Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026

In September 2026, threat actors launched a sophisticated ClickFix campaign exploiting OpenAI's Custom GPT feature to deliver remote access Trojans (RATs). Attackers created malicious Custom GPTs mimicking legitimate ChatGPT releases, leveraging trusted domains from OpenAI and Google to deceive victims. The attack chain began when users interacted with fake Custom GPTs named "Plus 5.6" through the official ChatGPT domain, then redirected to a Google Sites page with fake CAPTCHA prompts. Victims were tricked into executing PowerShell commands that downloaded MSI files, which used legitimate Canon-signed applications to sideload malicious DLLs and deploy RATs capable of data theft, surveillance, and network infiltration. Huntress security researchers documented at least 40 confirmed incidents from this campaign. This attack represents an evolution in social engineering tactics, exploiting trust in AI platforms and legitimate cloud infrastructure to bypass traditional security awareness training focused on domain verification.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells
Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells
Financial Services1 month ago

Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells

In October 2026, threat actors actively exploited CVE-2026-88771, a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway devices. The attackers leveraged this 9.5 CVSS-rated flaw to deploy sophisticated post-exploitation payloads, including Python reverse shells and Perl scripts that created superuser accounts, archived configuration data, and installed PHP web shells disguised as legitimate CSS resources. LevelBlue's research revealed exploitation attempts across multiple customer environments, with attackers using malicious authentication events containing 'pitboss' and 'NSPPE' strings to execute arbitrary commands and establish persistent access. This incident highlights the growing sophistication of network infrastructure attacks, where adversaries combine critical vulnerabilities with advanced evasion techniques to maintain persistence while blending malicious resources with legitimate web assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp
Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp
Computer Software/Engineering1 month ago

Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp

In September 2026, Apple patched CVE-2026-86950, a critical CoreGraphics vulnerability that may have been exploited in highly sophisticated zero-click attacks against specific targeted individuals. The flaw allows malicious PDFs with crafted embedded fonts to trigger memory corruption on unpatched iPhones and Macs. Security researchers at Calif published the first public proof-of-concept, demonstrating how attackers can cause controlled out-of-bounds writes through malformed TrueType fonts. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 2026. Evidence suggests WhatsApp may have been used as a delivery vector, as Meta Product Security was credited with the discovery and recent WhatsApp versions include new PDF attachment scanning capabilities. This incident highlights the continuing evolution of zero-click exploits targeting messaging platforms and document processing frameworks, representing a significant threat to high-value targets including government officials, journalists, and activists who rely on secure communications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Computer/Network Security1 month ago

Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026

In October 2026, Google released Gemini 4 Argon, an advanced AI model with autonomous vulnerability discovery capabilities, to trusted cyber defenders through its Fairwind Program. The model demonstrates unprecedented ability to find, validate, and patch critical software vulnerabilities, including discovering a previously unknown critical healthcare software vulnerability affecting hospitals worldwide. Google plans to release a version without cyber guardrails to trusted defenders while implementing safeguards against misalignment and indirect prompt injections. This incident highlights the emerging dual-use nature of AI security tools, where advanced models capable of autonomous vulnerability discovery can be weaponized by malicious actors if proper controls aren't maintained, representing a new frontier in AI security risks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports