Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 289 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 3457–3468 / 3490 reports
Hackers Deploy Advanced Botnet Over Exposed Docker APIs via Tor (2025)
Information Technology/IT10 months ago

Hackers Deploy Advanced Botnet Over Exposed Docker APIs via Tor (2025)

In September 2025, a sophisticated threat campaign was uncovered targeting exposed Docker APIs, where attackers leveraged the Tor network to obfuscate their activities and deploy a new, evolving botnet. The attackers used automated scanning to discover open Docker API endpoints (commonly on port 2375), then executed a multi-stage infection chain utilizing malicious containers. These payloads established persistent SSH access, blocked further exploitation by others, and launched additional tools for internal scanning, lateral movement, and covert communication. While earlier versions dropped cryptominers, the updated tooling focused on botnet expansion, user monitoring, and groundwork for additional attacks such as credential theft or DDoS. This incident exemplifies the rapid shift toward automation and stealth in cloud-native threats. Its relevance is underscored by the proliferation of misconfigured APIs and cloud workloads, combined with attackers’ increasing use of anonymizing networks (like Tor) and multi-vector attacks. Organizations with exposed or poorly secured container environments are urgently at risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Ransomware's New Playbook: 2024 Sophisticated Extortion Hits Major Enterprises
Financial Services10 months ago

Ransomware's New Playbook: 2024 Sophisticated Extortion Hits Major Enterprises

In early 2024, a prominent enterprise fell victim to a highly sophisticated ransomware attack orchestrated by the notorious LockBit gang. Attackers gained entry through compromised credentials, swiftly encrypting critical systems and demanding a $30 million ransom within 72 hours, threatening public data exposure. The perpetrators leveraged professional, SaaS-style operations, exploiting sensitive internal documentation—such as financials and cyber insurance details—to tailor their extortion tactics. Business operations were severely disrupted as the company rushed to contain the breach, initiate crisis response procedures, and engage third-party negotiators. This incident underscores the growing maturity of ransomware groups, who now use advanced negotiation and psychological tactics alongside technical exploits. The increased reliance on credential theft and swift lateral movement, combined with extortion strategies targeting both IT infrastructure and organizational psychology, reflects a broader trend impacting all sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Salesloft's GitHub Compromise Sparks 2024 Supply Chain Breach
Computer Software/Engineering10 months ago

Salesloft's GitHub Compromise Sparks 2024 Supply Chain Breach

In early 2024, Salesloft experienced a significant cybersecurity breach after attackers compromised a developer's GitHub account. By exploiting weak authentication protocols, threat actors were able to steal OAuth tokens, which enabled them to access and manipulate connected Salesforce instances of downstream customers, resulting in a widespread supply chain attack. The attackers leveraged their foothold to propagate malicious code and gain privileged access to hundreds of enterprise environments, exposing sensitive data and business operations across multiple organizations. This incident highlights the escalating risk presented by software supply chain attacks, particularly those exploiting code repositories and third-party integrations. It underscores the urgent need for organizations to implement strong access controls, enforce zero trust principles, and continuously monitor code and account activity in their development workflows.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)
Telecommunications10 months ago

45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)

In mid-2024, security researchers uncovered that the China-based Advanced Persistent Threat group Salt Typhoon (UNC4841) had deployed 45 new domains and previously undiscovered infrastructure to facilitate persistent, stealthy compromises of targeted organizations. Exploiting their advanced tradecraft, Salt Typhoon gained and maintained long-term access undetected, leveraging encrypted traffic and lateral movement techniques. The attacks primarily targeted sectors with sensitive data and critical infrastructure, amplifying operational and reputational risk for the victims. The campaign demonstrates ongoing actor adaptation and the challenges of detecting covert infrastructure expansion. This incident is especially relevant as organizations face a surge in nation-state actor activity leveraging novel infrastructure and sophisticated evasion methods. The discovery highlights the evolving threat landscape, where increased regulatory pressure and cloud adoption make comprehensive visibility and proactive response capabilities more critical than ever.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
MostereRAT Malware: New Era of EDR Bypass and Persistent Threats
Financial Services10 months ago

MostereRAT Malware: New Era of EDR Bypass and Persistent Threats

In 2024, security researchers uncovered a sophisticated campaign deploying the 'MostereRAT' malware against Windows environments. The threat actor used advanced techniques to deliver an EDR (Endpoint Detection and Response)-killing tool, enabling long-term, covert persistence on infected systems. MostereRAT blends into legitimate network traffic, leverages encrypted channels, and systematically disables or bypasses security controls, making detection and remediation difficult. Impacted organizations faced risks of data exfiltration, lateral movement, and significant business disruption, with attackers maintaining access for extended periods before discovery. This incident highlights the increasing prevalence of anti-EDR malware designed to counter modern defensive capabilities. As organizations adopt stronger endpoint security, attackers are deploying stealthier, more evasive malware, presenting ongoing challenges for incident detection, compliance, and cyber resilience.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Logit-Gap Steering: New Jailbreak Threat Undermines LLM Security in 2024
Computer Software/Engineering10 months ago

Logit-Gap Steering: New Jailbreak Threat Undermines LLM Security in 2024

In mid-2024, academic security researchers unveiled a novel attack against large language models (LLMs) termed "logit-gap steering." This technique exploits the mathematical limits of alignment training by manipulating the logits—the raw output probabilities—of refusal and affirmation tokens. Attackers found that by identifying and minimizing the gap through tailored prompt suffixes, they could frequently bypass internal model guardrails and elicit harmful or disallowed responses, even on the latest open-source models such as gpt-oss-20b, LLama, Gemma, and Qwen. The published methodology demonstrated over 75% attack success rates and triggered industry-wide concern about the resilience of current AI safety controls. This incident comes at a pivotal time as organizations accelerate adoption of AI and generative language models in production. The research spotlights a significant, previously underestimated vector for LLM jailbreak attacks, amplifying regulatory scrutiny and forcing enterprises to re-evaluate security practices for AI deployments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Remote Code Execution via Model Namespace Reuse Hits AI Supply Chains
Computer Software/Engineering10 months ago

Remote Code Execution via Model Namespace Reuse Hits AI Supply Chains

In early 2024, security researchers identified a novel AI supply-chain attack involving 'model namespace reuse' on popular machine learning platforms such as Hugging Face. Threat actors exploited the inherent trust in model names and namespaces to upload malicious AI models, thereby enabling remote code execution upon download or integration into downstream applications. The attack allowed adversaries to compromise systems within seconds of a user or developer integrating tainted models, potentially resulting in data breach, lateral movement, or disruption of AI-driven business processes. This incident underscores the growing risk within the AI and ML ecosystem, where reliance on third-party and community-contributed models is accelerating. As more organizations rapidly adopt AI across production workloads, supply-chain vulnerabilities like namespace reuse present urgent challenges for security and compliance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The New Insider Threat: How a Fake Employee Infiltrated a Tech Giant in 2025
Information Technology/IT10 months ago

The New Insider Threat: How a Fake Employee Infiltrated a Tech Giant in 2025

In August 2025, an advanced cyberattack targeted a major tech company when an attacker successfully joined the organization as a new employee using a fabricated identity, bypassing digital and in-person HR and IT onboarding checks. The attacker, under the alias 'Jordan from Colorado,' leveraged expertly forged credentials and references to gain legitimate system access and privileges from day one. Once inside, the attacker rapidly accessed sensitive data, established lateral footholds through internal network movement, and deployed covert remote access tools. The business suffered significant intellectual property theft and operational disruptions before the activity was detected during a routine audit. The incident demonstrates a rising trend in identity-based infiltration, where social engineering is used not to breach perimeters but to abuse trusted onboarding processes. This kind of attack highlights the urgent need for organizations to modernize identity verification and insider threat detection in response to sophisticated credential fraud and evolving attacker tradecraft.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Sitecore Zero-Day Breach: ViewState Exploits Lead to Remote Code Execution
Computer Software/Engineering10 months ago

Sitecore Zero-Day Breach: ViewState Exploits Lead to Remote Code Execution

In early 2024, threat actors exploited a zero-day vulnerability in Sitecore's ASP.NET-based content management system by weaponizing exposed machine keys, enabling remote code execution via malicious ViewState deserialization. Attackers bypassed authentication controls to inject arbitrary code and gain persistent control over vulnerable web servers, leading to potential data exfiltration and site takeover. Multiple Sitecore installations globally were at risk, highlighting weaknesses in secure key management and web application security monitoring. Organizations faced reputational and operational impacts as attackers abused trusted digital experiences to deliver malware and conduct further intrusions. The incident is part of a broader surge in deserialization and code injection attacks targeting legacy .NET applications. Zero-day exploitation against business-critical CMS platforms increases urgency for robust segmentation, runtime detection, and zero trust controls to defend against rapidly evolving attack techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Sitecore Vulnerabilities: Cache Poisoning and RCE Exploit Chain Uncovered (2025)
Computer Software/Engineering10 months ago

Sitecore Vulnerabilities: Cache Poisoning and RCE Exploit Chain Uncovered (2025)

In August 2025, researchers disclosed an exploit chain in the Sitecore Experience Platform involving three newly uncovered vulnerabilities—CVE-2025-53693 (HTML cache poisoning), CVE-2025-53691 (remote code execution via insecure deserialization), and CVE-2025-53694 (not yet detailed). The flaws allow attackers to first poison cached content by manipulating reflected inputs, and then leverage insecure deserialization to remotely execute arbitrary code on targeted Sitecore servers. If exploited, these issues can expose sensitive data and potentially compromise the full web application environment of affected organizations, particularly in sectors relying on large-scale digital experience management. This incident highlights the persistent risk of chained application vulnerabilities enabling critical attacks, such as lateral movement and RCE, within enterprise environments. With web applications being frequent targets and exploit code often surfacing soon after disclosures, organizations must prioritize proactive vulnerability management and robust segmentation to contain blast radius.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Attackers Exploit Velociraptor Forensics Tool for Covert C2 Tunneling With Visual Studio Code
Computer/Network Security10 months ago

Attackers Exploit Velociraptor Forensics Tool for Covert C2 Tunneling With Visual Studio Code

In June 2025, cybersecurity researchers reported a sophisticated incident in which attackers abused the open-source forensic tool Velociraptor to deploy Visual Studio Code on compromised endpoints and establish an encrypted command-and-control (C2) channel. Threat actors leveraged the legitimate forensic software as a Living Off The Land Binary (LOLBin) to evade detection, achieve execution, and enable covert lateral movement within enterprise environments. This innovative TTP circumvented traditional perimeter detections, and resulted in unauthorized access to sensitive internal systems, raising concerns over the misuse of trusted IT tools in targeted intrusions and potential data exfiltration. The incident highlights a growing trend of blending legitimate IT and developer software within attack chains, making malicious activity harder to distinguish from normal operations. Organizations face increasing regulatory and operational pressure to implement robust east-west traffic monitoring, behavioral detection, and zero trust controls as attackers adopt stealthier methods.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Amazon Stops APT29 Watering Hole Leverage of Microsoft Device Code
Government Administration10 months ago

Amazon Stops APT29 Watering Hole Leverage of Microsoft Device Code

In August 2025, Amazon Security Intelligence teams detected and disrupted a sophisticated nation-state watering hole campaign attributed to the Russian-linked APT29 group. The attackers compromised multiple legitimate websites, redirecting unsuspecting visitors to malicious infrastructure designed to exploit Microsoft's device code authentication flow. By tricking users into authorizing attacker-controlled devices, APT29 was able to gain unauthorized access to victim accounts and sensitive data. The rapid response by Amazon limited the scope of the compromise, but the incident highlights evolving tactics by advanced persistent threats targeting cloud identity systems. This incident is notable for its exploitation of widely used authentication protocols and the opportunistic use of trusted websites for redirection. It reflects a broader escalation in targeted attacks on cloud identities and authentication flows, as well as the sophistication of nation-state threat actors seeking persistent access to corporate and government assets.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports