Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3497 threat reports
Page 255 of 292
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3049–3060 / 3497 reports
CISA Flags Active Exploitation of 2025 Gladinet CentreStack, Triofox, and CWP Control Web Panel Flaws
Government Administration10 months ago

CISA Flags Active Exploitation of 2025 Gladinet CentreStack, Triofox, and CWP Control Web Panel Flaws

In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) identified and announced active exploitation of two critical vulnerabilities: CVE-2025-11371 in Gladinet CentreStack and Triofox (files or directories exposed to external parties), and CVE-2025-48703 in CWP Control Web Panel (an OS command injection flaw). Threat actors are leveraging these weaknesses to gain unauthorized file access or execute malicious code within affected environments, targeting organizations across sectors. The vulnerabilities enable lateral movement, data exfiltration, and potentially full compromise, with significant risk to sensitive data, business operations, and regulatory posture for organizations running vulnerable systems. This announcement underscores a broader trend of attackers exploiting unpatched software vulnerabilities in common enterprise tools. With automatic exploitation kits and a growing focus on file-sharing and web panel infrastructure, organizations face urgent pressure to accelerate vulnerability management and adopt Zero Trust practices to contain and monitor internal threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SesameOp: AI API Abused as C2 in Advanced Malware Attack (2024)
Financial Services10 months ago

SesameOp: AI API Abused as C2 in Advanced Malware Attack (2024)

In early 2024, cybersecurity researchers uncovered a sophisticated malware campaign involving the "SesameOp" backdoor, which leveraged OpenAI's API as a covert Command and Control (C2) channel. Threat actors behind this attack established persistence within targeted organizations using a custom Linux backdoor, routing communications through encrypted API calls to OpenAI infrastructure, thus evading traditional detection methods. The malware's use of legitimate AI service channels enabled threat actors to obfuscate malicious activity, complicating incident response and extending dwell time inside compromised environments. The incident underscored the rapid innovation of attacker tactics and the challenges enterprises face as generative AI ecosystems become embedded in critical workflows. This breach exemplifies a wider, emerging risk: attackers abusing popular cloud-based and AI-driven services for lateral movement, data exfiltration, and stealthy C2 operations. With AI adoption accelerating across industries, security teams must urgently reassess control frameworks, enhance anomaly detection, and enforce visibility on legitimate platforms often overlooked in legacy monitoring.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Apple Patches 110 Vulnerabilities in Massive 2024 Security Update
Computer Software/Engineering10 months ago

Apple Patches 110 Vulnerabilities in Massive 2024 Security Update

In early November 2024, Apple released urgently needed security updates for its operating systems, patching 110 vulnerabilities across iOS, macOS, iPadOS, watchOS, tvOS, visionOS, Safari, and Xcode. Key vulnerabilities included memory corruption flaws in ImageIO and WebKit, with previous instances of such bugs leading to remote code execution. Several vulnerabilities could allow unauthorized access to sensitive user data or privilege escalation, and most major Apple product families were impacted. No active exploitation was reported, but these vulnerabilities posed significant risks, especially if exploited in the wild. This incident underscores the importance of timely patching for organizations leveraging Apple hardware, amid escalating regulatory expectations and sophisticated exploit development targeting zero-day vulnerabilities. With Apple devices often pivotal in hybrid and remote work environments, large-scale multi-platform vulnerabilities present an attack surface of interest to both cybercriminals and nation-state actors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
SnakeStealer: 2024's Most Prolific Infostealer and Its Impact on Data Security
Financial Services10 months ago

SnakeStealer: 2024's Most Prolific Infostealer and Its Impact on Data Security

In early 2024, cybersecurity researchers identified a widespread surge in SnakeStealer malware infections targeting individuals and organizations across multiple sectors. This sophisticated infostealer penetrates devices through malicious attachments and compromised software, rapidly harvesting valuable personal and corporate information including browser credentials, cryptocurrency wallets, and sensitive documents. Once data is collected, it is exfiltrated to attacker-controlled servers, fueling cybercrime operations and secondary attacks. The rapid spread and effectiveness of SnakeStealer has led to significant business and operational risks, such as unauthorized access, data breaches, and identity theft. This incident highlights the escalating threat posed by modern infostealers, which continue to evolve their techniques to bypass security controls and evade detection. The sustained activity of SnakeStealer, coupled with copycat variants, underscores a trend of increasingly sophisticated, financially motivated cybercrime targeting both enterprise and individual data at scale.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Rogue Incident Responders Deploy ALPHV/BlackCat Ransomware Against US Companies
Health Care / Life Sciences10 months ago

Rogue Incident Responders Deploy ALPHV/BlackCat Ransomware Against US Companies

In 2023, three US-based cybersecurity professionals, including an incident response manager from Sygnia and a ransomware negotiator from DigitalMint, were indicted after orchestrating a wave of ransomware attacks using the ALPHV/BlackCat strain. Beginning in May 2023, the group compromised five US organizations spanning healthcare, pharmaceuticals, engineering, and tech, deploying ransomware to encrypt critical data and extort payments. Only a Florida medical company paid, sending nearly $1.3 million in ransom; the other four victims did not make payments. The attacks were uncovered through joint law enforcement efforts, leading to arrests and criminal charges for the conspirators. This case is significant as it highlights the ongoing risk of insider threats even among trusted cybersecurity professionals. The exploitation of privileged insider knowledge paired with advanced ransomware-as-a-service tooling demonstrates how internal actors can subvert security postures, fueling industry concerns about vigilance, vetting, and zero trust principles within security teams.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How OAuth Device Code Phishing Targets Azure and Google: What CISOs Need to Know in 2024
Computer Software/Engineering10 months ago

How OAuth Device Code Phishing Targets Azure and Google: What CISOs Need to Know in 2024

In 2024, new phishing campaigns emerged that weaponize the OAuth Device Code flow against major cloud platforms, notably Azure and Google. Attackers send users to authentic device code portals, tricking them into entering codes controlled by adversaries. Once codes are entered, threat actors receive valid OAuth tokens granting extensive access to cloud services, often bypassing multi-factor authentication. Researchers noted that Azure’s device flow presented a larger attack surface than Google’s, making it a high-value target for phishing and account compromise. The result is unauthorized access to sensitive email, data, and other cloud resources, with potential for lateral movement and persistent compromise. This breach showcases a rapidly escalating attack vector exploiting weaknesses in cloud identity flows. The rise in device code phishing reflects a broader shift by threat actors toward abusing legitimate authentication processes, especially as organizations depend more heavily on cloud services and OAuth-based SSO.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's WSUS Security Patch Disrupts Windows Server 2025 Hotpatching
Information Technology/IT10 months ago

Microsoft's WSUS Security Patch Disrupts Windows Server 2025 Hotpatching

In June 2024, Microsoft released an out-of-band (OOB) security update to address an actively exploited vulnerability within Windows Server Update Services (WSUS). While the patch mitigates a critical security risk, it has inadvertently broken hotpatching functionality on certain Windows Server 2025 systems. Hotpatching allows for critical updates without rebooting servers, so this unintended consequence impacts business continuity and planned maintenance windows, affecting organizations relying on continuous operation. This incident highlights the ongoing challenges of patch management, especially when rapid updates for zero-day vulnerabilities disrupt core services. As threat actors increasingly target software supply chains and patch-delivery mechanisms, IT teams face growing pressure to balance security and operational stability.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Microsoft 2024: SesameOp Backdoor Hides in OpenAI Assistants API Traffic
Information Technology/IT10 months ago

Microsoft 2024: SesameOp Backdoor Hides in OpenAI Assistants API Traffic

In early 2024, Microsoft researchers identified a sophisticated cyberattack campaign leveraging the new SesameOp backdoor malware. This threat exploits the OpenAI Assistants API as a covert command-and-control (C2) channel, enabling attackers to execute commands, exfiltrate data, and maintain persistence within compromised environments while masquerading as legitimate AI-driven traffic. The campaign targets organizations by bypassing traditional detection methods, using this unique abuse of generative AI services to hide communications and evade security controls. The operational impact is significant, posing increased risk for data loss, lateral movement, and regulatory exposure due to the highly obfuscated methodology. This incident underscores a rapid evolution in attacker tradecraft, with adversaries now weaponizing mainstream AI APIs for malicious infrastructure. As organizations accelerate adoption of AI technologies, this event highlights the urgency to address emerging risks of shadow AI and sophisticated backdoors, making robust east-west traffic inspection and AI-risk governance more important than ever.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Insiders Indicted: BlackCat Ransomware Attacks Orchestrated by US Cybersecurity Experts (2023)
Computer/Network Security10 months ago

Insiders Indicted: BlackCat Ransomware Attacks Orchestrated by US Cybersecurity Experts (2023)

Between May and November 2023, three former employees of DigitalMint and Sygnia—both incident response firms—were indicted following allegations that they leveraged insider knowledge to facilitate BlackCat (ALPHV) ransomware attacks on five U.S. companies. These individuals reportedly gained unauthorized access to sensitive networks, deployed BlackCat ransomware, and demanded significant payouts, resulting in operational disruptions, data encryption, and potential data exposure for affected organizations. The attackers’ technical expertise made detection difficult, and their actions exploited gaps in internal network security, east-west monitoring, and threat detection protocols. This incident highlights the evolving threat posed by malicious insiders and the intersection of human risk with sophisticated ransomware-as-a-service operations. The case underscores the urgency for organizations to enhance identity-based segmentation, rigorous monitoring of internal activity, and to adapt cybersecurity policies to counter both external and internal threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Lazarus Group Orchestrates Major 2025 Web3 Multi-Vector Breach
Financial Services10 months ago

Lazarus Group Orchestrates Major 2025 Web3 Multi-Vector Breach

In November 2025, the Lazarus Group executed a sophisticated multi-vector attack campaign targeting several high-profile Web3 and cryptocurrency organizations. Utilizing social engineering and supply-chain attacks, the threat actors exploited newly disclosed vulnerabilities in trusted hardware (including Intel and AMD TEEs) mere hours after public disclosures. Attackers employed encrypted C2 channels, lateral movement tools, and advanced ransomware, allowing them to bypass internal segmentation and traverse east-west across internal networks. The result was significant compromise of sensitive assets, encrypted backups, and leakage of confidential data, leading to operational disruption and reputational harm to victims. This incident is especially noteworthy due to the rapid attacker adaptation to zero-day vulnerabilities, the blending of traditional and cloud-native threat techniques, and Lazarus’s evolution in targeting decentralized platforms. The attack highlights the increasing complexity and urgency of defending distributed infrastructure against agile, persistent threat actors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TruffleNet Attack Highlights Urgent AWS Cloud Credential Risks
Financial Services10 months ago

TruffleNet Attack Highlights Urgent AWS Cloud Credential Risks

In early 2024, a sophisticated campaign dubbed 'TruffleNet' leveraged stolen credentials to infiltrate Amazon Web Services (AWS) environments. Attackers, believed to leverage components of TruffleHog, obtained valid credentials via phishing and credential theft, bypassing weak controls to gain access to cloud accounts. Following initial compromise, the threat actors engaged in reconnaissance, lateral movement, and business email compromise (BEC) activities, exploiting privileges to move within the cloud infrastructure and exfiltrate sensitive data. The incident resulted in significant risk of data loss and operational disruption for affected organizations, highlighting the dangers of identity-based attacks in cloud environments. This attack reflects an escalating trend of attackers targeting cloud platforms through abused credentials and automated open-source tooling. Organizations face increased regulatory scrutiny and operational risk, underscoring the critical need for zero trust segmentation, strong identity controls, and real-time monitoring of cloud platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WSUS CVE-2025-59287: Mass Scanning and Rapid Exploitation Threaten IT Infrastructure
Government Administration10 months ago

WSUS CVE-2025-59287: Mass Scanning and Rapid Exploitation Threaten IT Infrastructure

In late October and early November 2025, security researchers observed a marked uptick in external scans targeting ports 8530/TCP and 8531/TCP, which are related to Microsoft Windows Server Update Services (WSUS). These scans were linked to the rapid exploitation of CVE-2025-59287, a critical vulnerability allowing remote attackers to execute unauthorized scripts on vulnerable WSUS servers. Threat actors leveraged both encrypted (TLS) and unencrypted channels, beginning with reconnaissance sweeps and quickly escalating to full network compromise of exposed endpoints. Given the public availability of exploit details and the speed of attacks, organizations with exposed WSUS servers have likely suffered unauthorized access or larger breaches. This incident highlights a surge in opportunistic exploitation of newly disclosed vulnerabilities, particularly affecting critical IT infrastructure. The level of automated scanning and rapid weaponization is emblematic of a broader trend: attackers systematically hunting for internet-exposed administration interfaces and supply-chain services, increasing regulatory and operational risks for enterprises.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports