Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 285 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3409–3420 / 3490 reports
Microsoft Seizes RaccoonO365: 2024’s Largest Phishing-as-a-Service Credential Theft Takedown
Health Care / Life Sciences10 months ago

Microsoft Seizes RaccoonO365: 2024’s Largest Phishing-as-a-Service Credential Theft Takedown

In July 2024, Microsoft’s Digital Crimes Unit, in collaboration with law enforcement and cybersecurity partners, led a takedown of RaccoonO365—a subscription-based phishing-as-a-service platform operated by the threat group Storm-2246. Over 338 domains linked to RaccoonO365 were seized after being used to steal more than 5,000 Microsoft credentials across 94 countries since July 2024. The group’s kits, leveraging sophisticated evasion techniques and authentic-looking Microsoft branding, enabled cybercriminals to mount tax-themed and healthcare-targeted phishing campaigns, with sessions often bypassing multifactor authentication to harvest both passwords and session cookies. The breadth and pace of RaccoonO365’s operations highlight the commoditization and professionalization of cybercrime. This incident signals a shift towards scalable, as-a-service attack tools, increasing risks to organizations globally. Security teams must rapidly adapt to evolving TTPs and plug new identity-driven attack pathways, especially as phishing toolkits grow in accessibility and sophistication.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CHILLYHELL and ZynorRAT: Cross-Platform RATs Evade Detection, Threaten Enterprise Environments (2025)
Financial Services10 months ago

CHILLYHELL and ZynorRAT: Cross-Platform RATs Evade Detection, Threaten Enterprise Environments (2025)

In September 2025, security researchers from Jamf Threat Labs uncovered two sophisticated malware strains: CHILLYHELL, a modular backdoor targeting macOS systems, and ZynorRAT, a Go-based remote access trojan spreading across Windows and Linux environments. CHILLYHELL, written in C++ for Intel macOS architectures, enables persistent remote access and exfiltrates sensitive data, while ZynorRAT facilitates cross-platform attacks and lateral movement. Both threats leverage encrypted communications and modular payloads to evade detection and expand their reach, highlighting attackers’ increasing investment in multi-OS toolkits. The campaign impacted diverse sectors by undermining endpoint trust and exposing organizations to data breaches, extortion, and operational disruption. This incident reflects an ongoing surge in cross-platform malware development, with adversaries targeting heterogeneous enterprise environments using advanced, modular code. The discovery underscores heightened regulatory scrutiny around endpoint security, zero trust enforcement, and incident response as ransomware and espionage risks escalate.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know
Financial Services10 months ago

Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know

In late July 2025, threat actors affiliated with the Akira ransomware group launched a wave of attacks by exploiting a vulnerability and misconfigurations in SonicWall SSL VPN appliances. Cybersecurity firm Rapid7 reported a notable surge in intrusions targeting these devices, leveraging unsecured remote access pathways for initial compromise. Once inside, attackers escalated privileges, moved laterally, and deployed ransomware to encrypt critical data, causing extensive operational disruptions for affected organizations. The attacks highlighted gaps in east-west traffic monitoring, segmentation, and visibility, leaving many networks vulnerable to rapid malware spread and data loss. This breach underscores ongoing ransomware innovation and the persistent targeting of networking appliances as low-hanging fruit for initial access. It also reveals the increasing urgency for organizations to enforce zero trust network segmentation, proactively patch perimeter devices, and continuously monitor for anomalous access to defend against evolving ransomware threats and regulatory scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344
Banking/Mortgage10 months ago

HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344

In September 2025, researchers at ESET identified a new ransomware variant named HybridPetya that combines destructive Petya/NotPetya traits with advanced UEFI attack capabilities. Leveraging the CVE-2024-7344 vulnerability, attackers were able to bypass UEFI Secure Boot, allowing the malware to execute at a privileged level prior to OS load. Initial infection vectors appear to include phishing emails and software supply-chain compromises, leading to widespread disruption of targeted organizations’ endpoints, encrypted data, and in some instances, bricked devices. The attack highlights a disturbing escalation in ransomware sophistication and targeting, with significant operational downtime and financial losses reported in affected sectors. HybridPetya represents an evolution in ransomware, merging firmware exploitation with traditional payload delivery to maximize impact. This incident underscores the expanding threat landscape as adversaries weaponize newly discovered vulnerabilities and aim higher up the trust chain, intensifying pressure on organizations to harden their endpoints and update defenses in real time.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Samsung’s 2025 Critical Mobile Zero-Day: CVE-2025-21043 Exploited in the Wild
Telecommunications10 months ago

Samsung’s 2025 Critical Mobile Zero-Day: CVE-2025-21043 Exploited in the Wild

In September 2025, Samsung urgently patched a critical zero-day vulnerability (CVE-2025-21043) impacting its Android devices. The flaw, an out-of-bounds write in the libimagecodec.quram.so library, enabled remote attackers to execute arbitrary code on affected devices. This zero-day had been actively exploited in real-world attacks prior to disclosure and patch release, exposing millions of Galaxy smartphone users to the risk of compromise and potential data theft. Samsung responded by releasing its monthly security updates addressing the vulnerability before widespread exploitation could escalate. This incident underscores the persistent targeting of mobile platforms using advanced zero-day techniques, raising concerns for enterprises reliant on mobile endpoints. As threat actors innovate and focus on mobile ecosystems, rapid patch cycles and vigilant threat monitoring remain essential to protect against evolving exploitation methods.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Alert: UNC6040 & UNC6395 Target Salesforce in Sophisticated Data Theft and Extortion Attack
Computer Software/Engineering10 months ago

FBI Alert: UNC6040 & UNC6395 Target Salesforce in Sophisticated Data Theft and Extortion Attack

In mid-2025, the FBI issued a critical alert warning organizations about two cybercriminal groups, UNC6040 and UNC6395, conducting coordinated data theft and extortion attacks targeting enterprise Salesforce environments. Attackers leveraged multiple initial access vectors—believed to include credential compromise and social engineering—to infiltrate Salesforce platforms, exfiltrating sensitive data at scale. The breach campaigns led to severe business interruptions, reputational damage, and raised concerns over cloud infrastructure security, particularly in environments perceived as “well-defended.” FBI guidance included new indicators of compromise and proactive defense measures for cloud-hosted SaaS platforms. This incident marks a shift in threat actor focus toward high-value SaaS platforms, demonstrating the growing sophistication and persistence of financially-motivated attackers. It underscores the urgency for robust controls around identity, east-west traffic, and cloud-native visibility, as attack surfaces expand in digital-first enterprises.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Mass Browser-Based Attack Hits Enterprises: 2025’s Session Hijacking Wakeup Call
Financial Services10 months ago

Mass Browser-Based Attack Hits Enterprises: 2025’s Session Hijacking Wakeup Call

In August 2025, a sophisticated wave of browser-based attacks exploited vulnerabilities in popular browser components to hijack user sessions across multiple financial and technology firms simultaneously. Attackers leveraged phishing lures and malicious advertising to distribute payloads capable of intercepting authentication tokens and session cookies, enabling widespread unauthorized access. The campaign, attributed to a financially motivated eCrime group, enabled lateral movement within compromised cloud and SaaS applications, resulting in significant data exfiltration, temporary access loss, and incident-driven downtime for several affected organizations. This incident underscores a dramatic uptick in browser-native TTPs targeting identity, session integrity, and trusted cloud access. Threat actors are exploiting the growing reliance on web-based workflows and overlooked intra-browser security, making enhanced endpoint monitoring and Zero Trust controls more urgent than ever.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Self-Replicating Worm Strikes npm: 2025 Supply Chain Attack Exposes Critical Credential Risks
Computer Software/Engineering10 months ago

Self-Replicating Worm Strikes npm: 2025 Supply Chain Attack Exposes Critical Credential Risks

In September 2025, a major supply chain attack targeted the npm ecosystem, compromising over 40 packages and impacting projects worldwide. Attackers utilized a self-replicating worm delivered via manipulated npm modules; these modules would download, alter, and republish themselves by embedding malicious scripts directly into package files. As a result, sensitive developer credentials and system access tokens were harvested at scale, putting thousands of developer environments and downstream applications at risk, eroding trust in open-source software supply chains. This campaign highlights the growing risk and sophistication of supply chain attacks leveraging automated propagation across trusted developer channels. With the expanding reliance on open-source components and increasing regulatory scrutiny, organizations must urgently strengthen controls around development pipelines and dependency security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Apple 2025 ImageIO Zero-Day Breach Highlights Spyware Risks
Computer Software/Engineering10 months ago

Apple 2025 ImageIO Zero-Day Breach Highlights Spyware Risks

In September 2025, Apple urgently released backported security updates to address CVE-2025-43300, a critical out-of-bounds write vulnerability in the ImageIO component exploited by advanced spyware campaigns. Attackers leveraged malicious image files to trigger memory corruption on Apple devices, enabling remote code execution and potential device takeover. The exploit was actively seen in targeted attacks against high-profile individuals, emphasizing the risk of spyware abusing zero-day vulnerabilities for persistent surveillance. The incident underscores the growing sophistication and frequency of attacks exploiting media processing flaws. This breach highlights an intensifying trend of threat actors using zero-day vulnerabilities in consumer devices for espionage. It demonstrates how attackers pivot to less-monitored device components and rapidly weaponize novel flaws, reinforcing the urgent need for continuous patching and proactive detection of anomalous behaviors on endpoints.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chaos Mesh Critical GraphQL Flaws Put Kubernetes Clusters at Risk in 2025
Information Technology/IT10 months ago

Chaos Mesh Critical GraphQL Flaws Put Kubernetes Clusters at Risk in 2025

In September 2025, multiple critical vulnerabilities were discovered in Chaos Mesh, a popular cloud-native chaos engineering platform, exposing Kubernetes clusters to remote code execution (RCE) via unauthenticated GraphQL endpoints. Attackers with minimal in-cluster network access could exploit these flaws to execute arbitrary code, trigger disruptive fault injections (such as pod deletion and network outages), and ultimately achieve full cluster takeover. The vulnerability stemmed from insufficient access controls and improper GraphQL API handling, allowing adversaries to escalate privileges and compromise cluster workloads. As a result, organizations relying on Chaos Mesh in production faced heightened risk to workload integrity and business continuity until patches were applied. This breach highlights the increasing threat to supply-chain components in cloud-native environments, where tools with high privileges can inadvertently expose entire clusters. The rapid disclosure and fix cycle signals a need for strict RBAC, vigilant monitoring, and timely patching as attacker focus shifts towards exploiting platform-level risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Microsoft & Cloudflare Dismantle RaccoonO365 Global Phishing Network (2025)
Financial Services10 months ago

Microsoft & Cloudflare Dismantle RaccoonO365 Global Phishing Network (2025)

In September 2025, Microsoft’s Digital Crimes Unit (DCU), in partnership with Cloudflare, coordinated a global takedown of the RaccoonO365 phishing network. The PhaaS operation leveraged 338 domains to deliver convincing Microsoft 365 phishing campaigns, compromising over 5,000 credentials across 94 countries since July 2024. By obtaining a court order from the Southern District of New York, DCU seized infrastructure used by the financially motivated RaccoonO365 group, disrupting ongoing credential theft and reducing further business email compromise (BEC) risk to organizations worldwide. This incident underscores the rapid evolution and global scale of phishing-as-a-service networks, which are automating credential theft across cloud platforms. As attackers exploit trusted SaaS brands with commodity toolkits, vigilance around cloud identity and supply chain access is now a critical board-level concern.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TA558 Leverages AI-Generated Scripts to Deploy Venom RAT in 2025 Brazilian Hotel Attacks
Hospitality10 months ago

TA558 Leverages AI-Generated Scripts to Deploy Venom RAT in 2025 Brazilian Hotel Attacks

In the summer of 2025, the threat actor group TA558 launched a series of targeted phishing campaigns against hotels and the hospitality sector in Brazil and other Spanish-speaking regions. Leveraging AI-generated scripts, TA558 distributed Remote Access Trojans (RAT) such as Venom RAT via malicious email attachments disguised as business invoices. The attackers gained unauthorized access to hotel infrastructure, enabling surveillance, data theft, and lateral movement within targeted environments. Kaspersky researchers attributed the activity to the RevengeHotels cluster and noted reliance on sophisticated social engineering and automation. This incident exemplifies the rising integration of AI in cyberattacks, increasing the efficacy and resilience of threat actors like TA558. Organizations in hospitality and other sectors with valuable customer data face growing risks from AI-driven malware and must adapt their defenses to faster-evolving adversarial techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports