Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 287 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3433–3444 / 3490 reports
Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)
Information Technology/IT10 months ago

Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)

In early June 2024, multiple critical vulnerabilities known collectively as "Chaotic Deputy" were disclosed in Chaos Mesh, a widely used open-source chaos engineering platform for Kubernetes. These bugs, including authentication bypass and privilege escalation flaws, allowed unauthorized attackers to obtain elevated access within Kubernetes clusters. Exploitation could lead to total cluster takeover, lateral movement, and the compromise of sensitive resources and data across affected environments. The disclosure prompted rapid patches from maintainers and advisories from security organizations and cloud providers due to the severe risk and broad adoption of Chaos Mesh in enterprise deployments. This incident highlights the increasing focus of attackers and researchers on the Kubernetes and supply chain ecosystem. With Kubernetes now foundational to cloud-native infrastructure, vulnerabilities in operational tools like Chaos Mesh underline the need for robust segmentation, continuous security monitoring, and timely patch management to protect against emerging threats to hybrid and multi-cloud environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
Computer Software/Engineering10 months ago

SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR

In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics. This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)
Computer Software/Engineering10 months ago

Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)

In early 2024, multiple leading code assistant platforms powered by Large Language Models (LLMs) were found to be vulnerable to security threats such as indirect prompt injection, model misuse, and code suggestion manipulation. Attackers exploited weaknesses in prompt handling and insufficient contextual isolation, allowing harmful code or misleading content to be surfaced to end users and potentially exposing enterprise environments to supply chain risks. These risks highlight the growing attack surface in organizations leveraging AI-driven development tools, where impaired oversight can lead to deceptive or insecure code entering production systems. This incident underscores the urgency for enterprises to evaluate the deployment and integration practices for generative AI tools, particularly given the rapid rise in adoption and regulatory focus on AI safety. Attacker tactics are evolving quickly, and threat actors are increasingly targeting AI models and their usage contexts as a new cyber frontier.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple’s 2025 Zero-Day Puts iOS & macOS Security in Spotlight: What You Need to Know
Computer Software/Engineering10 months ago

Apple’s 2025 Zero-Day Puts iOS & macOS Security in Spotlight: What You Need to Know

In September 2025, Apple issued urgent patches for iOS, iPadOS, and macOS in response to several critical vulnerabilities, with CVE-2025-43300 standing out due to active exploitation in sophisticated targeted attacks. The vulnerability, affecting the ImageIO component, enabled attackers to compromise devices by processing malicious image files, potentially resulting in memory corruption and enabling unauthorized access or control. Previous patches were limited to the latest OS versions, leaving older systems exposed until this coordinated rollout addressed those gaps. Apple further backported fixes to supported older releases to mitigate the heightened risk of exploitation. This incident underscores an accelerating wave of zero-day vulnerabilities leveraged in real-world attacks, highlighting the persistent threats facing major software ecosystems like Apple’s. The discovery and rapid backporting response reflects mounting regulatory and industry pressure to quickly secure even legacy platforms and close compliance gaps.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Phoenix Attack Bypasses DDR5 Rowhammer Defenses in 2025
Financial Services10 months ago

Phoenix Attack Bypasses DDR5 Rowhammer Defenses in 2025

In September 2025, researchers from ETH Zurich and Google disclosed the 'Phoenix' attack—a novel Rowhammer-based hardware vulnerability that successfully bypasses the Target Row Refresh (TRR) defenses in popular DDR5 memory chips, specifically targeting modules from market leader SK Hynix. By exploiting specific shortcomings in TRR’s sampling intervals and synchronizing access over precise refresh cycles, the Phoenix attack can reliably induce bit flips in physical memory. In controlled tests, the attack enabled researchers to gain root-level privileges on commodity systems in under two minutes, expose sensitive cryptographic keys across virtual machines, and manipulate binaries such as sudo for rapid local privilege escalation. The vulnerability, now tracked as CVE-2025-6202, impacts DDR5 modules manufactured between January 2021 and December 2024, posing industry-wide risk since current mitigations are ineffective for existing hardware. This incident stands out as it revives concerns over hardware-level attacks that are resistant to conventional software security solutions. As threats like Phoenix emerge, it highlights the rapid evolution of side-channel and privilege-escalation techniques even in the face of new hardware protections, underlining the pressing need for industry collaboration and innovation on memory security standards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious MCP Servers: How AI Supply Chain Integrations Were Weaponized in 2024
Computer Software/Engineering10 months ago

Malicious MCP Servers: How AI Supply Chain Integrations Were Weaponized in 2024

In early 2024, security researchers uncovered a novel supply chain attack exploiting the Model Context Protocol (MCP), an emerging integration layer for AI assistants. Attackers published seemingly legitimate MCP servers on public repositories such as PyPI, which, once installed by developers, silently harvested sensitive credentials, SSH keys, cloud configs, and API secrets. Data exfiltration was cleverly disguised as benign HTTP requests to plausible endpoints, while the malicious packages mimicked real productivity tools, evading both user scrutiny and common detection mechanisms. This attack leveraged implicit trust in third-party AI extensions, exposing a major blind spot for organizations integrating AI into development workflows. This breach reflects a growing trend where adversaries weaponize trusted AI integration points, mirroring techniques seen in Open Source and DevOps supply chain compromises. As enterprise AI adoption accelerates, similar threats targeting protocol-level integration, plugin ecosystems, and shadow AI deployments are expected to rise, intensifying regulatory and governance pressures around software supply chain security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Inside the 2025 Salesloft Drift SaaS Supply Chain Breach: Lessons in Token Management
Computer Software/Engineering10 months ago

Inside the 2025 Salesloft Drift SaaS Supply Chain Breach: Lessons in Token Management

In early 2025, a significant supply chain breach occurred when threat actor UNC6395 exploited a dormant OAuth token from a third-party Salesloft Drift integration within a Salesforce environment. Leveraging the compromised token—which bypassed MFA—the attacker launched automated connections from multiple unknown VPNs, enumerating CRM accounts and exfiltrating customer data, including embedded credentials. This enabled lateral movement, granting persistent, unauthorized access to hundreds of downstream client Salesforce instances and facilitating privilege escalation into additional systems via harvested secrets. The incident underscores an urgent trend of attackers exploiting inadequately governed third-party integrations, token sprawl, and absent monitoring. With growing SaaS adoption and rising API-driven architectures, identity-driven supply chain attacks have become top risks, accelerating regulatory scrutiny and industry demand for automated token hygiene, lifecycle management, and more rigorous third-party security postures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Gentlemen Ransomware Exploits Vulnerable Driver to Disable Enterprise Security (2024)
Financial Services10 months ago

Gentlemen Ransomware Exploits Vulnerable Driver to Disable Enterprise Security (2024)

In early 2024, the Gentlemen ransomware group executed a sophisticated attack leveraging a vulnerable version of the ThrottleStop.sys driver to disable antivirus and endpoint detection and response (EDR) systems. By exploiting this signed but flawed driver, the attackers were able to gain kernel-level privileges, terminate security defenses, and deploy ransomware effectively across targeted organizations. The impact resulted in rapid file encryption, significant operational disruption, and increased ransom demands as incident response capabilities were bypassed. This incident highlights the growing trend of ransomware operators abusing trusted, vulnerable drivers to evade security controls. The ease with which attackers weaponize driver vulnerabilities underscores the urgent need for organizations to enhance driver and device control, patch management, and implement Zero Trust security strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
SonicWall Firewalls Under Siege: Akira Ransomware Exploits CVE-2024-40766
Financial Services10 months ago

SonicWall Firewalls Under Siege: Akira Ransomware Exploits CVE-2024-40766

Between July and August 2024, Akira ransomware affiliates targeted SonicWall firewall devices by exploiting CVE-2024-40766, a vulnerability in the SSL VPN protocol, combined with widespread configuration errors. Despite the availability of patches, attackers successfully accessed devices where remediation steps such as local password resets after firmware upgrades and proper multi-factor authentication (MFA) implementation were neglected. These campaigns leveraged misconfigured LDAP group permissions and compromised credentials to gain initial access, enabling Akira to steal sensitive data and encrypt systems across numerous organizations. The resulting attacks led to data theft, system downtime, and expensive ransom demands, with impacts observed globally, including within Australia. Akira’s ongoing surge illustrates the growing sophistication and persistence of ransomware groups in targeting both unpatched and improperly configured perimeter devices. This attack wave highlights the critical need for organizations to not only apply security patches promptly but to rigorously follow up with secure configuration and identity management measures to prevent operational and financial losses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AsyncRAT Attackers Exploit ConnectWise ScreenConnect—Credential & Crypto Theft on the Rise
Computer Software/Engineering10 months ago

AsyncRAT Attackers Exploit ConnectWise ScreenConnect—Credential & Crypto Theft on the Rise

In September 2025, cybersecurity researchers identified a sophisticated attack leveraging the ConnectWise ScreenConnect remote monitoring tool to deliver AsyncRAT, a potent remote access trojan. Threat actors exploited legitimate RMM infrastructure to establish unauthorized access, bypass defenses, and deploy a VBScript-based loader on victim systems. Once installed, AsyncRAT facilitated unauthorized credential harvesting and cryptocurrency theft from compromised hosts, exposing sensitive business and personal data. The campaign’s use of trusted IT management software as an initial entry vector complicated detection and posed significant risks to organizations relying on remote administration tools. This incident underscores an increasing security challenge: the abuse of legitimate remote management solutions by attackers to evade detection and propagate malware. As identity-driven and tool-based attacks surge, businesses must re-examine their controls, segmentation, and monitoring to counter exploitation of sanctioned IT utilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft September 2025 Patch Tuesday: Critical Vulnerabilities in Cloud, URL Security Zones, and More
Financial Services10 months ago

Microsoft September 2025 Patch Tuesday: Critical Vulnerabilities in Cloud, URL Security Zones, and More

On September 9, 2025, Microsoft released its September Patch Tuesday updates, addressing 177 vulnerabilities across its ecosystem, including 86 that impacted Microsoft products directly. Among these, 13 were rated as critical, and two had already been publicly disclosed. Notable vulnerabilities included improper URL security zone classification (CVE-2025-54107, CVE-2025-54917), which could allow attackers to bypass security features, and several remote code execution flaws affecting critical workloads. While none of these vulnerabilities were exploited before disclosure, their wide range—including issues in Azure, Office, and the Windows kernel—signals continued risk across cloud and on-premises environments. These vulnerabilities highlight evolving attacker techniques, such as zone misclassification and privilege escalation in cloud services, while underscoring the complexity of patch management in hybrid infrastructures. The scale of affected Microsoft and open-source components (like Azure Linux/Mariner) points to the growing regulatory and operational urgency for comprehensive and timely vulnerability management.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait
Computer Software/Engineering10 months ago

Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait

In early 2024, Vyro AI experienced a significant data leak involving the unintentional exposure of proprietary and sensitive user data via a GenAI platform. The incident occurred when internal users, unaware of best security practices, shared confidential information with generative AI tools that did not have adequate encryption or access controls. This exposed private data to unauthorized individuals and third parties, highlighting deficiencies in the company’s data protection policies and cloud application oversight. This breach is emblematic of the growing risks associated with GenAI usage in enterprise environments, where shadow IT and user-driven data sharing can sidestep traditional security controls. As organizations adopt AI at scale, ensuring robust data governance and compliance is more critical than ever to avoid regulatory and reputational fallout.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports