The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3375 threat reports
Page 282 of 282
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3373–3375 / 3375 reports
Chinese APT Exploits Cisco AsyncOS Zero-Day in 2025: What You Need to Know
Government Administration10 months ago

Chinese APT Exploits Cisco AsyncOS Zero-Day in 2025: What You Need to Know

In December 2025, Cisco disclosed an unpatched, maximum-severity zero-day vulnerability (CVE-2025-20393) affecting AsyncOS running on Cisco Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances with exposed Spam Quarantine features. Leveraging this zero-day, the Chinese-nexus APT group UAT-9686 exploited systems by executing commands as root, deploying persistent backdoors (AquaShell), reverse SSH tunnels (AquaTunnel, Chisel), and evasion tools (AquaPurge). The campaign was active from late November 2025, with intrusions traced to sophisticated nation-state tooling and lateral movement, potentially compromising sensitive email infrastructure and enabling persistent access. This incident underscores ongoing risks from zero-day exploitation by advanced threat actors, especially those leveraging public-facing management interfaces and unpatched systems for initial access. The active exploitation by a Chinese APT mirrors broader trends in targeted cyberespionage against enterprise collaboration tools and highlights the urgency of proactive exposure management and segmentation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
State-Backed Attackers Breach SonicWall SMA1000 Devices via Zero-Day Chain in 2025
Computer/Network Security10 months ago

State-Backed Attackers Breach SonicWall SMA1000 Devices via Zero-Day Chain in 2025

In December 2025, SonicWall urgently advised customers to patch a newly identified zero-day vulnerability (CVE-2025-40602) in its SMA1000 Appliance Management Console after attackers exploited it in the wild. The attack chain combined this medium-severity local privilege escalation flaw with a critical pre-authentication deserialization vulnerability (CVE-2025-23006), allowing remote unauthenticated threat actors to execute arbitrary OS commands with root privileges on vulnerable appliances. These appliances serve as secure remote access gateways for large enterprises and critical infrastructure, amplifying the risk of broad organizational compromise and lateral movement within protected networks. The incident follows prior breaches and repeated targeting of SonicWall solutions by sophisticated, potentially state-backed actors, with over 950 SMA1000 devices found internet-exposed. Immediate remediation was urged to prevent further exploitation amidst evidence of active, targeted attacks. The SonicWall SMA1000 incident underscores a persistent trend of advanced actors leveraging zero-day exploits in network infrastructure appliances, fueling urgency around patch management and segmentation. This breach highlights the evolving complexity of attack chains targeting foundational remote access technologies and the critical need for proactive defense-in-depth and threat visibility measures.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How Weaxor Ransomware Leveraged the React2Shell Vulnerability in 2025
Computer Software/Engineering10 months ago

How Weaxor Ransomware Leveraged the React2Shell Vulnerability in 2025

In December 2025, cybercriminals exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components and Next.js to gain unauthorized access to a corporate endpoint. Within seconds, attackers deployed the Weaxor ransomware strain, rapidly encrypting files and appending a '.WEAX' extension, while dropping ransom notes named 'RECOVERY INFORMATION.txt' in each directory. The attack began by delivering an obfuscated PowerShell command, installing a Cobalt Strike beacon for command-and-control, disabling Windows Defender, wiping shadow copies, and clearing logs to evade detection and hinder forensic analysis. Researchers confirmed there was no lateral movement or data exfiltration prior to encryption, and the targeted machine was subsequently compromised by additional threat actors. This incident highlights the widespread exploitation of recently disclosed vulnerabilities by both ransomware gangs and nation-state actors. With opportunistic attacks increasing in speed and automation, organizations must improve patch velocity and advanced monitoring to defend against emerging, rapidly weaponized threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports