The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3375 threat reports
Page 276 of 282
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3301–3312 / 3375 reports
Self-Replicating Worm Strikes npm: 2025 Supply Chain Attack Exposes Critical Credential Risks
Computer Software/Engineering9 months ago

Self-Replicating Worm Strikes npm: 2025 Supply Chain Attack Exposes Critical Credential Risks

In September 2025, a major supply chain attack targeted the npm ecosystem, compromising over 40 packages and impacting projects worldwide. Attackers utilized a self-replicating worm delivered via manipulated npm modules; these modules would download, alter, and republish themselves by embedding malicious scripts directly into package files. As a result, sensitive developer credentials and system access tokens were harvested at scale, putting thousands of developer environments and downstream applications at risk, eroding trust in open-source software supply chains. This campaign highlights the growing risk and sophistication of supply chain attacks leveraging automated propagation across trusted developer channels. With the expanding reliance on open-source components and increasing regulatory scrutiny, organizations must urgently strengthen controls around development pipelines and dependency security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Apple 2025 ImageIO Zero-Day Breach Highlights Spyware Risks
Computer Software/Engineering9 months ago

Apple 2025 ImageIO Zero-Day Breach Highlights Spyware Risks

In September 2025, Apple urgently released backported security updates to address CVE-2025-43300, a critical out-of-bounds write vulnerability in the ImageIO component exploited by advanced spyware campaigns. Attackers leveraged malicious image files to trigger memory corruption on Apple devices, enabling remote code execution and potential device takeover. The exploit was actively seen in targeted attacks against high-profile individuals, emphasizing the risk of spyware abusing zero-day vulnerabilities for persistent surveillance. The incident underscores the growing sophistication and frequency of attacks exploiting media processing flaws. This breach highlights an intensifying trend of threat actors using zero-day vulnerabilities in consumer devices for espionage. It demonstrates how attackers pivot to less-monitored device components and rapidly weaponize novel flaws, reinforcing the urgent need for continuous patching and proactive detection of anomalous behaviors on endpoints.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chaos Mesh Critical GraphQL Flaws Put Kubernetes Clusters at Risk in 2025
Information Technology/IT9 months ago

Chaos Mesh Critical GraphQL Flaws Put Kubernetes Clusters at Risk in 2025

In September 2025, multiple critical vulnerabilities were discovered in Chaos Mesh, a popular cloud-native chaos engineering platform, exposing Kubernetes clusters to remote code execution (RCE) via unauthenticated GraphQL endpoints. Attackers with minimal in-cluster network access could exploit these flaws to execute arbitrary code, trigger disruptive fault injections (such as pod deletion and network outages), and ultimately achieve full cluster takeover. The vulnerability stemmed from insufficient access controls and improper GraphQL API handling, allowing adversaries to escalate privileges and compromise cluster workloads. As a result, organizations relying on Chaos Mesh in production faced heightened risk to workload integrity and business continuity until patches were applied. This breach highlights the increasing threat to supply-chain components in cloud-native environments, where tools with high privileges can inadvertently expose entire clusters. The rapid disclosure and fix cycle signals a need for strict RBAC, vigilant monitoring, and timely patching as attacker focus shifts towards exploiting platform-level risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Microsoft & Cloudflare Dismantle RaccoonO365 Global Phishing Network (2025)
Financial Services9 months ago

Microsoft & Cloudflare Dismantle RaccoonO365 Global Phishing Network (2025)

In September 2025, Microsoft’s Digital Crimes Unit (DCU), in partnership with Cloudflare, coordinated a global takedown of the RaccoonO365 phishing network. The PhaaS operation leveraged 338 domains to deliver convincing Microsoft 365 phishing campaigns, compromising over 5,000 credentials across 94 countries since July 2024. By obtaining a court order from the Southern District of New York, DCU seized infrastructure used by the financially motivated RaccoonO365 group, disrupting ongoing credential theft and reducing further business email compromise (BEC) risk to organizations worldwide. This incident underscores the rapid evolution and global scale of phishing-as-a-service networks, which are automating credential theft across cloud platforms. As attackers exploit trusted SaaS brands with commodity toolkits, vigilance around cloud identity and supply chain access is now a critical board-level concern.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TA558 Leverages AI-Generated Scripts to Deploy Venom RAT in 2025 Brazilian Hotel Attacks
Hospitality9 months ago

TA558 Leverages AI-Generated Scripts to Deploy Venom RAT in 2025 Brazilian Hotel Attacks

In the summer of 2025, the threat actor group TA558 launched a series of targeted phishing campaigns against hotels and the hospitality sector in Brazil and other Spanish-speaking regions. Leveraging AI-generated scripts, TA558 distributed Remote Access Trojans (RAT) such as Venom RAT via malicious email attachments disguised as business invoices. The attackers gained unauthorized access to hotel infrastructure, enabling surveillance, data theft, and lateral movement within targeted environments. Kaspersky researchers attributed the activity to the RevengeHotels cluster and noted reliance on sophisticated social engineering and automation. This incident exemplifies the rising integration of AI in cyberattacks, increasing the efficacy and resilience of threat actors like TA558. Organizations in hospitality and other sectors with valuable customer data face growing risks from AI-driven malware and must adapt their defenses to faster-evolving adversarial techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
ChillyHell: The macOS Backdoor That Outsmarted Notarization in 2024
Government Administration9 months ago

ChillyHell: The macOS Backdoor That Outsmarted Notarization in 2024

In early May 2024, security researchers from Jamf Threat Labs identified a new version of the previously dormant "ChillyHell" modular backdoor targeting macOS systems. Initially observed in attacks against Ukrainian officials in 2021 and reported again by Mandiant in 2023, ChillyHell resurfaced in a sample uploaded to VirusTotal and discovered to have been publicly hosted on Dropbox. The malware achieves persistence through multiple mechanisms, brute-forces passwords, exfiltrates sensitive data, and communicates over several protocols, all while leveraging Apple notarization to evade detection before its certificates were revoked. With built-in timestamp manipulation and extensive C2 capabilities, ChillyHell poses a significant risk to macOS enterprise environments, blending stealth, flexibility, and longevity in its operations. This incident underscores the growing sophistication and targeting of macOS platforms by advanced threat actors, moving beyond Windows-centric malware trends. The use of valid codesigning and notarization further demonstrates challenges for defenders, highlighting the need for robust detection controls and ongoing vigilance for notarized—but malicious—macOS software.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Enhanced Malware: How EvilAI’s Stealth Attacks Redefined Cyber Threats in 2024
Financial Services9 months ago

AI-Enhanced Malware: How EvilAI’s Stealth Attacks Redefined Cyber Threats in 2024

In early 2024, cybersecurity researchers identified a widespread campaign leveraging 'EvilAI'—a threat actor embedding artificial intelligence into seemingly legitimate productivity apps to deliver advanced malware. These AI-backed tools enable the malware to evade traditional antivirus detection, utilizing encrypted traffic and adaptive, stealthy behavior to propagate across organizational networks. The primary attack vectors were phishing emails and malicious downloads, which provided initial access before lateral movement was observed within compromised environments. As a result, hundreds of companies worldwide suffered business disruptions, data theft, and increased recovery costs from incident response efforts. This incident highlights the escalating sophistication of malware campaigns driven by artificial intelligence. The fusion of classic malware tactics with AI-enabled evasion makes traditional security controls less effective, underlining the urgency for organizations to adopt advanced, behavior-based defenses and prioritize zero trust architectures to mitigate evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CERT-FR Uncovers Advanced Apple Spyware Exploitation in 2024
Government Administration9 months ago

CERT-FR Uncovers Advanced Apple Spyware Exploitation in 2024

In June 2024, a CERT-FR advisory revealed the exploitation of a zero-day vulnerability within Apple operating systems, alleged to be leveraged in targeted spyware attacks against select individuals. Discovered after reports of 'sophisticated' exploitation, the flaw allowed attackers to covertly gain access to devices, harvest sensitive data, and monitor communications by bypassing security defenses. Attackers deployed advanced tactics to deliver the payload, focusing on high-profile victims with a history of surveillance targeting. Apple has since released security updates to address the vulnerability, but the impact underscores persistent risks to user privacy and national security. This incident is particularly relevant amid a surge in zero-day exploitation by sophisticated threat actors, highlighting the elevated risks posed by commercial spyware and surveillance tools. It also reinforces regulatory and enterprise urgency to enhance detection, patch management, and mobile endpoint security strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Alert: UNC6040 & UNC6395 Target Salesforce Customers with Cloud Attacks (2024)
Computer Software/Engineering9 months ago

FBI Alert: UNC6040 & UNC6395 Target Salesforce Customers with Cloud Attacks (2024)

In early 2024, the FBI’s Internet Crime Complaint Center (IC3) issued an alert detailing active campaigns by threat groups UNC6040 and UNC6395 targeting Salesforce customer environments. The attackers leveraged phishing and social engineering to obtain valid Salesforce credentials, subsequently exploiting misconfigurations and inadequate security controls in customer cloud instances. This enabled unauthorized access to sensitive data, including customer information and corporate records, leading to multiple data theft and extortion attempts. Salesforce itself was not breached, but its customers suffered direct operational impacts due to data compromise and disruption. This incident underscores a rising trend of advanced threat actors targeting supply chain and SaaS ecosystems, exploiting both human and technical gaps in cloud security. As cloud adoption accelerates, enterprises must address credential hygiene, proper configuration, and real-time anomaly detection to thwart similar attacks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
KillSec Ransomware Campaign Targets Brazilian Healthcare Supply Chain
Health Care / Life Sciences9 months ago

KillSec Ransomware Campaign Targets Brazilian Healthcare Supply Chain

In April 2024, the KillSec ransomware group orchestrated a cyberattack against a major Brazilian healthcare software provider, targeting a core element of the nation’s healthcare technology supply chain. According to cybersecurity researchers, the attackers leveraged sophisticated ransomware tactics to breach the provider’s environment, exfiltrate sensitive patient data, and subsequently encrypt vital systems, disrupting normal operations. The breach involved the theft of confidential healthcare records, potentially exposing personally identifiable information (PII) as well as critical medical data, raising alarms across Brazil’s healthcare sector. As a result, provider services experienced significant operational delays and financial impact, and the wider ecosystem faces cascading risks from the exposed data. This incident is particularly noteworthy due to the healthcare sector’s growing vulnerability to ransomware attacks, with supply chain vectors increasingly exploited by threat actors like KillSec. The event reflects a concerning trend of ransomware groups shifting toward critical infrastructure and service-provider targets, amplifying regulatory, compliance, and patient safety pressures.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
HybridPetya Ransomware: How Attackers Bypassed Secure Boot to Compromise UEFI
Banking/Mortgage9 months ago

HybridPetya Ransomware: How Attackers Bypassed Secure Boot to Compromise UEFI

In June 2024, cybersecurity researchers uncovered a new ransomware strain called 'HybridPetya' that combines elements of the notorious Petya and NotPetya malware families. This advanced ransomware specifically targets UEFI-based systems, bypassing Secure Boot protections by leveraging sophisticated bootkit techniques. HybridPetya infiltrates environments via spear-phishing and lateral movement, then encrypts critical system files at the firmware level, effectively crippling affected organizations and creating significant hurdles for recovery. Its wiper-like capabilities echo NotPetya’s destructive impacts, raising major concerns for enterprises with critical infrastructure or legacy firmware defenses. The emergence of HybridPetya underscores an escalation in attacker sophistication, with a resurgence in supply-chain and firmware-level attacks. The incident highlights the urgent need for proactive firmware security, robust patch management, and Zero Trust architectures to counter ransomware operators increasingly weaponizing advanced, persistent threat techniques.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Emerging Yurei Ransomware Claims First Victims in 2024
Financial Services9 months ago

Emerging Yurei Ransomware Claims First Victims in 2024

In early June 2024, a new ransomware operation identified as Yurei, reportedly originating from Morocco and named after Japanese spirits, claimed its first set of confirmed victims. The Yurei group leveraged a customized variant of the Prince-Ransomware binary, successfully breaching targets by deploying file-encrypting malware through typical ransomware vectors. Notably, researchers discovered that the malware implementation contained a technical flaw permitting partial data recovery, though this did not nullify the criminal extortion threats made against affected businesses. The attack has led to data loss, service interruption, and urgent incident response at affected organizations. This incident spotlights the evolving ransomware landscape, where new actors rapidly weaponize existing malware tools, often introducing subtle encryption modifications. Yurei’s activity shows how flaws in ransomware code do not necessarily mitigate risk, as extortion and operational disruption remain impactful. Organizations must adapt controls to defend against agile threat actors, even when exploits are imperfectly engineered.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports