Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 29 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 337–348 / 3490 reports
The New Face of Email Threats: How AI is Revolutionizing Social Engineering
The New Face of Email Threats: How AI is Revolutionizing Social Engineering
Financial Services1 month ago

The New Face of Email Threats: How AI is Revolutionizing Social Engineering

Modern email-based social engineering attacks have evolved significantly beyond traditional phishing methods, leveraging AI to craft sophisticated campaigns that bypass conventional security awareness training. Attackers now employ AI-powered tools to generate grammatically perfect content, use QR codes to evade URL inspection, and deploy techniques like ConsentFix and ClickFix that manipulate legitimate authentication flows. These attacks target active user sessions and authentication tokens rather than just passwords, with QR code phishing accounting for one in nine detected phishing emails in recent ESET telemetry. This evolution represents a critical shift in the threat landscape as cybercriminals increasingly weaponize AI to scale personalized attacks and exploit the expanding attack surface of cloud-native environments. Organizations must move beyond traditional awareness training to implement zero-trust verification controls and advanced detection capabilities that can identify sophisticated social engineering attempts in real-time.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
State Surveillance Exploits WhatsApp and Signal Device Linking Features
State Surveillance Exploits WhatsApp and Signal Device Linking Features
Law Enforcement1 month ago

State Surveillance Exploits WhatsApp and Signal Device Linking Features

German law enforcement has been exploiting device linking features in encrypted messaging apps WhatsApp and Signal to conduct surveillance operations. The technique involves connecting a police-controlled computer to a suspect's messaging account through either physical access to their device or intercepting verification codes via state-sanctioned phishing attacks and SMS interception. Once connected, all messages are delivered to the law enforcement device without breaking encryption, effectively bypassing the security protections these apps provide. This surveillance method has raised significant concerns about digital privacy and the potential for abuse of legitimate messaging features by state actors. This incident highlights the growing sophistication of state-sponsored surveillance techniques that exploit legitimate application features rather than traditional cryptographic attacks. As governments worldwide expand digital surveillance capabilities and encrypted communications become more prevalent, understanding these attack vectors is crucial for both individual privacy protection and organizational security planning.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Financial Services1 month ago

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

In September 2024, Citrix NetScaler appliances became targets of active zero-day exploitation involving CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on the CVSS scale. Attackers exploited a command injection vulnerability affecting all NetScaler devices in default configurations, achieving remote code execution. The incident was particularly notable for Citrix's delayed disclosure, leaving customers without official warnings for over 36 hours while exploitation was actively occurring. Security professionals, insurance providers, and researchers issued unofficial warnings through back channels before Citrix finally published patches and advisories. With over 50,000 publicly exposed NetScaler instances potentially vulnerable, the incident highlighted critical gaps in vendor communication during active exploitation scenarios. This incident underscores the growing trend of attackers targeting network infrastructure appliances as initial access vectors, particularly in an era where traditional perimeter security models are increasingly inadequate. The delayed vendor response demonstrates the urgent need for organizations to implement zero-trust architectures and real-time threat detection capabilities rather than relying solely on vendor patches and advisories.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Financial Services1 month ago

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

In December 2024, Kiteworks, a secure file transfer provider, issued an unprecedented advisory telling customers to take production systems offline following credible threat intelligence from federal authorities about an imminent cyberattack. The company proactively shut down customer environments over the weekend while working with federal intelligence agencies and security partners including Mandiant. During the shutdown, Kiteworks discovered and patched a critical vulnerability in their Advanced Forms product affecting approximately 50 organizations, with no evidence of exploitation. The company resumed normal operations after continuous monitoring showed no malicious activity. This incident highlights the growing trend of proactive threat response and public-private intelligence sharing in cybersecurity. As supply chain attacks continue to target file transfer and collaboration platforms, the willingness of vendors to prioritize security over operational convenience signals a maturation in industry threat response practices.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Government Administration1 month ago

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

In September 2026, CISA issued emergency directives ordering federal agencies to patch two critical Citrix NetScaler zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) by Wednesday after confirming active exploitation. The vulnerabilities allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, affecting thousands of internet-exposed instances. Threat actors were observed placing shellcode directly into memory on vulnerable systems, prompting national cybersecurity agencies to advise organizations to immediately shut down unpatched NetScaler deployments. This incident highlights the persistent targeting of network infrastructure appliances that serve as critical trust boundaries in enterprise environments. The rapid exploitation of these zero-days demonstrates the increasing sophistication of threat actors who can weaponize vulnerabilities within hours of discovery, making traditional patch cycles inadequate for defending against modern attack timelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials
Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials
Computer Software/Engineering1 month ago

Shadow AI Security Crisis: How 80,000+ Organizations Lost Control of AI Credentials

In August 2026, a massive credential theft campaign targeting AI platforms exposed over 80,000 organizations worldwide, with infostealers harvesting login credentials and session tokens from employees' personal devices. The attack primarily targeted ChatGPT users but also affected Claude, Hugging Face, Replit, and other AI services, with stolen credentials being sold on underground markets for unauthorized access and billing fraud. SOCRadar's research revealed that 68% of affected organizations were billion-dollar enterprises across 36 countries, with attackers gaining access to conversation histories containing sensitive corporate data, API keys, and OAuth tokens with standing permissions to other enterprise systems. This incident highlights the critical security risks of shadow AI adoption as organizations increasingly rely on AI assistants for business operations. The theft demonstrates how unmanaged AI tool usage creates new attack vectors for data exfiltration and unauthorized access to corporate resources, making AI platforms as critical as identity providers in enterprise security strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Financial Services1 month ago

Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know

CISA added two critical Citrix NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution through improper input validation in a Perl script, while CVE-2026-88772 (CVSS 9.5) enables RCE via memory buffer operations when DTLS is enabled. Attackers are exploiting these flaws to achieve root-level access on vulnerable NetScaler appliances, potentially compromising enterprise network infrastructure and VPN gateways. This incident highlights the continued targeting of network appliances as critical attack vectors, particularly as organizations expand their hybrid cloud deployments and remote access infrastructure. The pre-authentication nature of these exploits makes them especially dangerous for threat actors seeking initial network footholds.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
Information Technology/IT1 month ago

JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks

In June 2026, the JadePuffer ransomware operator (tracked by Microsoft as Storm-3168) conducted sophisticated AI-driven attacks against Azure cloud tenants using compromised service principals. The threat actor employed autonomous AI agents to automate the entire attack chain, including reconnaissance, credential theft, lateral movement, and destructive operations targeting over 100 storage accounts, Key Vaults, Function Apps, and Virtual Machines. The destructive phase lasted only seven minutes, with attackers systematically removing backup protections and attempting to make recovery more difficult to support potential ransomware extortion. This incident represents a critical evolution in ransomware tactics, demonstrating how threat actors are weaponizing AI agents to accelerate and scale cloud-native attacks. The emergence of agentic AI in cybercrime signals a new era of automated, intelligent threats that can operate at machine speed against cloud infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
Computer Software/Engineering1 month ago

How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026

In September 2026, cybersecurity researchers at UpGuard discovered over 16,000 misconfigured Supabase databases exposing sensitive data including personally identifiable information, passwords, and authentication tokens. The exposures affected diverse organizations globally, from a U.S. valet service with 100,000+ customer records to a Canadian immigration service with nearly 5,000 user records including 884 plaintext passwords. Researchers attributed these widespread misconfigurations to poor application security settings, missing row-level security policies, and the increasing use of AI-assisted development tools that create databases without proper security awareness from developers. This incident highlights the growing security risks associated with AI-powered development platforms and cloud database misconfigurations. As AI-assisted coding becomes more prevalent, accounting for over 60% of new Supabase databases, the potential for systematic security oversights increases dramatically, making comprehensive cloud security posture management and zero-trust architectures more critical than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence
Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence
Telecommunications1 month ago

Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence

Microsoft identified NeedyMantis, a sophisticated malware family used by Storm-3069 (suspected China-nexus threat actor) to maintain persistent access in targeted networks since October 2025. The malware employs DLL sideloading techniques with legitimate programs like Poedit, curl, and TightVNC to establish covert command-and-control channels via HTTPS and WebSocket connections. Organizations affected include telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors, with the campaign linked to the DAEMON Tools supply chain compromise discovered in May 2026. This incident highlights the growing sophistication of state-sponsored APT groups leveraging supply chain attacks and living-off-the-land techniques to achieve long-term persistence. The campaign demonstrates how threat actors are increasingly targeting critical infrastructure and sensitive sectors through legitimate software channels.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks
Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks
Computer Software/Engineering1 month ago

Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks

Apple disclosed CVE-2026-86950, a critical out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution through maliciously crafted files. Meta Product Security discovered this flaw, which Apple confirmed was exploited in sophisticated targeted attacks against specific individuals running iOS versions prior to iOS 27. The vulnerability affects older versions of iOS, iPadOS, and macOS, requiring users to update to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1 to mitigate the risk. This incident highlights the ongoing threat of zero-day exploits being weaponized in targeted surveillance campaigns, particularly as nation-state actors and sophisticated threat groups increasingly focus on mobile device exploitation for intelligence gathering operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Chrome Web Store Security Failure: How Poper Blocker Spyware Infected Millions
Chrome Web Store Security Failure: How Poper Blocker Spyware Infected Millions
Computer Software/Engineering1 month ago

Chrome Web Store Security Failure: How Poper Blocker Spyware Infected Millions

In 2026, researchers at Bay Area Labs discovered that 'Poper Blocker,' a malicious browser extension masquerading as an ad blocker, had been distributed through the Chrome Web Store to over 2 million users. Despite carrying Google's 'Featured' badge and 'Established Publisher' status, the extension functioned as sophisticated spyware, exfiltrating comprehensive browsing histories, screenshots, AI chatbot interactions from ChatGPT, Claude, and Gemini, and location data. The malware employed advanced evasion techniques including code obfuscation, sandbox detection, and command-and-control infrastructure to avoid detection while systematically harvesting sensitive user data for third-party monetization. This incident highlights the growing threat of supply chain attacks through legitimate app stores and the increasing sophistication of data theft operations targeting AI interactions and personal browsing data. With one in five popular ad blockers reportedly engaging in similar data exfiltration practices, organizations face mounting challenges in protecting against insider threats from seemingly trusted software sources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports