Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 284 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3397–3408 / 3490 reports
RaccoonO365: Microsoft & Cloudflare Take Down Major Phishing-as-a-Service Network in 2024
Health Care / Life Sciences10 months ago

RaccoonO365: Microsoft & Cloudflare Take Down Major Phishing-as-a-Service Network in 2024

In July 2024, Microsoft, in collaboration with Cloudflare and law enforcement, disrupted the RaccoonO365 Phishing-as-a-Service (PhaaS) operation, which enabled cybercriminals to launch large-scale phishing campaigns mimicking Microsoft 365 and other trusted brands. The service, run by Storm-2246 and attributed to Joshua Ogundipe, offered subscription-based kits that automated credential-theft campaigns targeting over 2,300 US organizations and at least 20 healthcare entities. The takedown involved seizing 338 domains, mapping the attack infrastructure, and revealing financial flows in cryptocurrency, shutting down an operation responsible for stealing at least 5,000 sets of credentials from 94 countries. This incident underscores the industrialization of phishing through subscription-based platforms and highlights how low-skill attackers are being enabled at scale. As phishing-as-a-service proliferates and leverages brand impersonation, organizations face escalating risks of credential theft and downstream ransomware or malware attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Scattered Lapsus$ Hunters: Hacking Groups Go Dark, But Risks Remain
Financial Services10 months ago

Scattered Lapsus$ Hunters: Hacking Groups Go Dark, But Risks Remain

In early 2024, the notorious Scattered Spider and Lapsus$ cybercriminal groups announced they were disbanding and ending their hacking campaigns, raising hopes of a reprieve from their disruptive cyberattacks. However, security researchers observed ongoing activity linked to these groups, including continued phishing, extortion, and data theft campaigns, suggesting the announcements may have been a smokescreen aimed at evading law enforcement scrutiny. The groups are known for high-profile intrusions into enterprise and technology organizations, frequently exploiting identity-based attacks and lateral movement to access sensitive data and systems, resulting in operational disruptions and significant data breaches. This incident highlights the persistent threat posed by organized cybercriminal groups that leverage identity-centric attack vectors and sophisticated social engineering, underscoring the necessity for robust segmentation, effective threat detection, and advanced access controls on corporate networks. Amid evolving attacker tactics and regulatory demands, organizations must prioritize zero trust strategies to defend against similar threats.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's September 2025 Patch: Critical Azure & SMB Vulnerabilities Fixed
Financial Services10 months ago

Microsoft's September 2025 Patch: Critical Azure & SMB Vulnerabilities Fixed

In September 2025, Microsoft released a critical security update addressing 80 vulnerabilities across its product suite, with particular focus on an SMB privilege escalation flaw and an Azure vulnerability rated CVSS 10.0. While eight of these vulnerabilities were classified as Critical and the rest as Important, none are reported to have been exploited in the wild at release. The patch release comes after public disclosures made some flaws widely known, elevating risk of exploitation. Microsoft urged organizations to immediately apply updates, highlighting the dangers posed by both privilege escalation and remote code execution vectors that could severely impact enterprise security. This incident underscores the continued rise in attacks targeting software supply chains and cloud platforms. With a surge in public disclosures and exploit tool availability, patch management has become both more challenging and more essential—particularly as attackers increasingly exploit unpatched vulnerabilities for lateral movement and privilege escalation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Google Chrome Zero-Day CVE-2025-10585: Exploit Puts Millions at Risk
Financial Services10 months ago

Google Chrome Zero-Day CVE-2025-10585: Exploit Puts Millions at Risk

In September 2025, Google addressed a critical security incident involving a zero-day vulnerability (CVE-2025-10585) within Chrome's V8 JavaScript and WebAssembly engine. This type confusion vulnerability was actively exploited in the wild, allowing attackers to execute arbitrary code in users’ browsers. The exploit’s ease of deployment and ability to bypass conventional browser defenses put millions of Chrome users at risk globally until Google released an urgent patch. The attack vector enabled threat actors to compromise targeted endpoints primarily through malicious web content. This incident highlights the ongoing proliferation and rapid exploitation of browser-based zero-days. Continuous advancements in attacker tactics—and their ability to weaponize browser vulnerabilities at scale—underscore the necessity for organizations to implement proactive patch management and behavioral threat detection aligned with zero trust strategies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SilentSync RAT Supply Chain Attack on PyPI Exposes Python Developer Ecosystem
Computer Software/Engineering10 months ago

SilentSync RAT Supply Chain Attack on PyPI Exposes Python Developer Ecosystem

In September 2025, cybersecurity researchers uncovered a sophisticated supply chain attack targeting Python developers through two malicious packages uploaded to the Python Package Index (PyPI) repository. These packages secretly deployed the SilentSync remote access trojan (RAT) onto Windows systems, enabling cybercriminals to execute remote commands, exfiltrate files, and capture screenshots from infected machines. The attackers leveraged trusted developer platforms to propagate their malware, increasing the risk of widespread compromise and posing a significant operational threat to organizations relying on open-source software dependencies. This incident highlights the ongoing risks associated with open-source ecosystems and third-party package repositories, which have become prime targets for threat actors. The escalation in supply chain attacks underscores the need for robust software supply chain security, vigilant dependency monitoring, and stronger policies governing the use of third-party code.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged
Computer/Network Security10 months ago

SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged

In September 2025, SonicWall disclosed a cloud security incident that exposed firewall configuration backup files tied to less than 5% of MySonicWall accounts, prompting a company-wide advisory to reset credentials for impacted users. The breach involved unauthorized access to backup firewall preference files hosted in SonicWall’s cloud backup service, which could potentially allow attackers insight into sensitive network policies and infrastructure details. Upon detection, SonicWall revoked affected credentials, reset authentication tokens, and notified regulatory authorities and end-users. The incident underscores operational risks associated with cloud-based configuration repositories and the downstream consequences for enterprise security posture. This breach highlights ongoing attacker focus on cloud storage services and device configuration files, which are increasingly targeted for initial access or lateral movement. As regulatory scrutiny grows and advanced threats seek out persistent footholds, organizations face mounting urgency to harden cloud storage, segment sensitive data, and enforce continuous credential hygiene.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
CountLoader: The Russian Ransomware Loader Redefining Post-Exploitation in 2025
Financial Services10 months ago

CountLoader: The Russian Ransomware Loader Redefining Post-Exploitation in 2025

In September 2025, cybersecurity researchers uncovered a major campaign involving CountLoader, a newly identified malware loader leveraged by Russian ransomware gangs. CountLoader has been deployed to infiltrate organizations by delivering post-exploitation tools such as Cobalt Strike, AdaptixC2, and the PureHVNC RAT via sophisticated phishing and initial access broker (IAB) operations. Notably, the loader is associated with affiliates of the LockBit ransomware group and is suspected to support both initial access sales and direct ransomware attacks. The campaign enabled attackers to establish stealthy persistence and remote control over compromised environments, amplifying threats of data theft, lateral movement, and disruptive encryption attacks. This incident highlights the growing adoption of multi-stage loader malware by established ransomware actors, blending traditional and cutting-edge post-exploitation tools for maximum impact. The tactics seen here illustrate the evolving, service-based ransomware ecosystem—one where payload delivery, access brokering, and command-and-control capabilities are modular and rapidly evolving in response to network defenses.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
GhostRedirector Backdoors Windows Servers with Malicious IIS Modules
Information Technology/IT10 months ago

GhostRedirector Backdoors Windows Servers with Malicious IIS Modules

In early 2024, ESET researchers uncovered a sophisticated cyber campaign known as GhostRedirector targeting Windows servers worldwide. The attacker employed a passive C++ backdoor and a malicious Microsoft IIS module, granting remote control and enabling the manipulation of Google search results. By compromising internet-facing IIS web servers, the threat actor covertly redirected visitors to malicious domains while maintaining persistent access through undetected, stealthy backdoors. The attack had the potential to facilitate broad influence operations, data exfiltration, and further deployment of malware on compromised networks. This incident highlights the growing risk of advanced web server threats utilizing legitimate application modules for stealthy persistence. Such tactics reflect a wider trend of attackers exploiting trusted infrastructure and automated SEO poisoning, challenging organizations to strengthen threat detection, zero trust controls, and incident response.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
HybridPetya Ransomware: UEFI Secure Boot Under Attack in 2024
Banking/Mortgage10 months ago

HybridPetya Ransomware: UEFI Secure Boot Under Attack in 2024

In June 2024, ESET researchers discovered a ransomware variant dubbed HybridPetya, modeled after the infamous Petya/NotPetya malware, with a significant escalation in its capabilities. HybridPetya leverages the CVE-2024-7344 vulnerability to compromise UEFI-based systems, effectively bypassing Secure Boot protections on outdated hardware. Although not known to be active in broad campaigns, this bootkit joins a small group of malware capable of undermining the fundamental trust mechanisms securing modern machines, representing a sophisticated evolution in ransomware delivery and persistence techniques. HybridPetya’s emergence highlights the rapid adaptation of cybercriminals to harden malware against defensive controls. UEFI bootkit methods—once advanced nation-state territory—are now appearing in ransomware. Organizations must urgently review endpoint protections, hardware patching, and secure boot configurations to lower exposure to these new attack paths.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
HybridPetya Ransomware: UEFI Secure Boot Bypass Proof-of-Concept Shakes Firmware Security
Health Care / Life Sciences10 months ago

HybridPetya Ransomware: UEFI Secure Boot Bypass Proof-of-Concept Shakes Firmware Security

In July 2025, ESET Research uncovered HybridPetya, a proof-of-concept ransomware closely mimicking the destructive Petya and NotPetya malware. HybridPetya features a novel UEFI bootkit component, capable of targeting both legacy and modern UEFI-based systems by exploiting CVE-2024-7344 to bypass Secure Boot protections. The malware operates by encrypting the Master File Table on NTFS partitions, leveraging advanced techniques such as malicious EFI application deployment and fake CHKDSK screens to evade detection. To date, ESET’s telemetry has found no evidence of HybridPetya in active attacks, and its development suggests an evolving threat landscape for ransomware targeting core system components. HybridPetya’s public discovery underscores an alarming trend: sophisticated ransomware is expanding its reach to firmware and boot processes, previously considered resilient to commodity malware. The rise of UEFI-targeting threats and Secure Boot bypass exploits highlights the urgent need for rigorous patch management and endpoint visibility, especially as new vulnerabilities (like CVE-2024-7344) become weaponized.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Apple Patches 100+ Vulnerabilities in 2025: What Enterprises Need to Know
Computer Software/Engineering10 months ago

Apple Patches 100+ Vulnerabilities in 2025: What Enterprises Need to Know

In September 2025, Apple released security updates for iPhones, iPads, Macs, and other products, addressing a total of over 100 vulnerabilities across its ecosystem. While none of the patched vulnerabilities were reported as actively exploited at the time, two severe macOS bugs (CVE-2025-43298 and CVE-2025-43304) were highlighted for their potential to confer root privileges to attackers. The updates followed a year marked by several Apple zero-days, some previously exploited in highly targeted attacks, underscoring ongoing risks to user data and privacy. Devices released prior to 2019 are no longer supported by the latest OS versions, leaving older hardware at higher risk. This incident highlights the persistent and evolving nature of software vulnerabilities targeting consumer platforms, reinforcing the critical importance of timely patching. With increasing regulatory attention and attackers swiftly weaponizing new bugs, organizations must remain vigilant in threat monitoring and adopt robust patch management practices.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
SonicWall 2024 Breach: Cloud Portal Attack Exposes Firewall Configurations
Financial Services10 months ago

SonicWall 2024 Breach: Cloud Portal Attack Exposes Firewall Configurations

In June 2024, SonicWall confirmed a security incident impacting its MySonicWall.com portal, where threat actors gained unauthorized access to backup firewall configuration files belonging to fewer than 5% of their customers. The attackers employed targeted brute-force attacks to access encrypted preference files stored in the cloud, potentially exposing sensitive network architecture and policy information. While SonicWall promptly disabled the affected backup feature, notified law enforcement and affected customers, and engaged incident response specialists, the exposure raises substantial risk of follow-on attacks and exploitation due to the detailed nature of the data compromised. This incident highlights a growing concern with threats targeting cloud-managed administrative platforms, especially those operated by key infrastructure vendors. As attackers pivot from device exploits to systemic attacks on cloud portals, organizations must scrutinize cloud data storage and vendor security practices more rigorously to mitigate downstream and supply chain risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports