Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 31 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 361–372 / 3490 reports
Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence
Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence
Financial Services1 month ago

Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence

In September 2026, Kiteworks (formerly Accellion) took the unprecedented step of urging customers to shut down their systems for nine hours as a precautionary measure after receiving credible threat intelligence from federal authorities about an imminent cyber attack. The company emphasized that no evidence of compromise was found and that all known vulnerabilities had been addressed in software release 9.5.1. This proactive response demonstrates how threat intelligence sharing between government agencies and private sector entities can enable preventive security measures. This incident highlights the growing sophistication of threat actor reconnaissance and the critical importance of proactive threat intelligence in modern cybersecurity defense strategies, particularly given the increasing frequency of supply chain and managed service provider attacks targeting multiple organizations simultaneously.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique
ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique
Higher Education/Acadamia1 month ago

ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique

The ShinyHunters-affiliated threat group UNC6240 launched a renewed mass exploitation campaign in September 2026, targeting Oracle PeopleSoft systems globally across education, healthcare, government, and technology sectors. The attackers weaponized CVE-2026-35273, a critical remote code execution vulnerability, by developing a WAF bypass technique using URL-encoded characters to evade security controls. The campaign deployed web shells on dozens of systems, established persistent access through legitimate RMM tools like MeshAgent, and deployed the SIDEEYE backdoor for credential theft and data exfiltration, ultimately leading to ransomware deployment and data extortion threats. This incident highlights the evolving sophistication of ransomware groups in bypassing modern security architectures, particularly the limitations of signature-based WAF protection against adaptive threat actors who can rapidly modify exploits to evade detection rules.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover
Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover
Computer Software/Engineering1 month ago

Elementor WordPress Plugin CSRF Vulnerability Exposes 2 Million Sites to Admin Account Takeover

A critical Cross-Site Request Forgery (CSRF) vulnerability in the Elementor WordPress plugin affected versions 4.3.0 and 4.3.1, impacting up to 2 million websites. The flaw allowed unauthenticated attackers to create administrator accounts by tricking logged-in administrators into clicking malicious links. The vulnerability exploited Elementor's Editor Events module, which bypassed WordPress's REST nonce validation when specific URI paths were present, enabling one-click privilege escalation attacks. Security firm Patchstack disclosed the vulnerability on September 22, 2026, and Elementor released a patch in version 4.3.2 within two days. This incident highlights the growing sophistication of web application attacks targeting popular content management systems and the critical importance of secure API design patterns in preventing privilege escalation vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence
Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence
Financial Services1 month ago

Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence

In September 2026, Kiteworks, a secure file-sharing platform used by government organizations and enterprises, issued an unprecedented global shutdown advisory after receiving credible threat intelligence from federal law enforcement. The company urged all customers worldwide to shut down their servers for a six-hour window to protect against potential zero-day attacks targeting their systems. While no actual breach was confirmed, the proactive measure highlighted the sophisticated threat landscape facing secure file transfer platforms that handle sensitive documents. The incident underscores the increasing sophistication of threat actors targeting enterprise file-sharing platforms, particularly following successful campaigns by groups like Clop ransomware gang against similar services. This preemptive approach represents a new paradigm in incident response, where organizations act on intelligence rather than waiting for active exploitation, reflecting the evolving threat landscape where secure file platforms have become high-value targets for data theft extortion operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How Threat Intelligence Stops Ransomware Before Encryption Begins
How Threat Intelligence Stops Ransomware Before Encryption Begins
Financial Services1 month ago

How Threat Intelligence Stops Ransomware Before Encryption Begins

Modern ransomware operations have evolved beyond simple file encryption to sophisticated multi-stage attacks utilizing Ransomware-as-a-Service (RaaS) models and double or triple extortion tactics. These attacks typically begin with initial access brokers selling compromised credentials, followed by lateral movement through networks before reaching the final encryption stage. The shift toward proactive threat intelligence enables security teams to identify warning signs earlier in the attack lifecycle, including exposed credentials in criminal marketplaces, malicious command-and-control infrastructure, and known attacker behavioral patterns. This intelligence-driven approach allows defenders to disrupt attacks during initial access and C2 phases rather than relying solely on post-encryption recovery measures. This approach is increasingly critical as ransomware groups continuously adapt their tactics, techniques, and procedures (TTPs) while leveraging initial access brokers and sophisticated infrastructure to target specific industries and geographies, making traditional reactive defenses insufficient against evolving threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SectopRAT Returns: How Attackers Hide Malware Inside Trusted Applications
SectopRAT Returns: How Attackers Hide Malware Inside Trusted Applications
Computer Software/Engineering1 month ago

SectopRAT Returns: How Attackers Hide Malware Inside Trusted Applications

In September 2026, Fortinet researchers discovered a new variant of SectopRAT (also known as ArechClient2) hidden within legitimate software from an Italian digital-audio company. The remote access Trojan was embedded after installation rather than through supply chain compromise, with attackers tampering with the FrameworkBase.dll file to secretly load the malicious payload. This .NET-based malware combines extensive remote control capabilities with information-stealing functionality, targeting browser credentials, cookies, payment data, and cryptocurrency wallets while using fully encrypted AES communications to evade detection. This incident highlights the evolving sophistication of post-compromise attacks where threat actors exploit organizational trust in legitimate applications. As SectopRAT activity surged throughout 2025 and continues into 2026, organizations face increasing risks from malware that bypasses traditional security scrutiny by masquerading as trusted software, demonstrating the critical need for behavioral monitoring rather than reputation-based trust models.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security
Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security
Government Administration1 month ago

Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security

CVE-2026-48842, a critical pre-authentication SQL injection vulnerability in Roundcube Webmail, is being actively exploited in the wild according to the Canadian Centre for Cyber Security. The flaw affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allowing unauthenticated attackers to inject arbitrary SQL statements through the virtuser_query plugin via a preg_replace() backslash escape bypass. Despite patches released in May 2026, threat actors continue targeting the over 523,000 Roundcube instances exposed to the internet, potentially accessing mail account credentials and stored messages. This incident highlights the persistent targeting of email infrastructure by threat actors, particularly following previous Roundcube exploits by China-aligned groups like UNK_MassTraction and the addition of other Roundcube vulnerabilities to CISA's Known Exploited Vulnerabilities catalog in early 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cloudflare Containers Vulnerability Exposes Cross-Tenant Data Through Disk Provisioning Flaw
Cloudflare Containers Vulnerability Exposes Cross-Tenant Data Through Disk Provisioning Flaw
Computer Software/Engineering1 month ago

Cloudflare Containers Vulnerability Exposes Cross-Tenant Data Through Disk Provisioning Flaw

In September 2026, security researcher Oren Yomtov discovered a critical vulnerability in Cloudflare Containers that allowed one customer's container to access leftover disk data from other customers' previously deleted containers. The flaw stemmed from improper disk provisioning configuration where deleted container blocks were returned to a shared pool without proper wiping, enabling cross-tenant data exposure. Researchers successfully recovered directory structures, SQLite databases, browser profiles, and credential files across 18 of 24 test attempts on production servers spanning four continents. Cloudflare fixed the issue by enabling proper block wiping and retiring all running containers, completing remediation on September 19, 2026. This incident highlights the growing risks in multi-tenant cloud infrastructure as organizations increasingly adopt containerized workloads and AI-driven development environments, making proper data isolation and secure deprovisioning critical for preventing cross-customer data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation
CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation
Government Administration1 month ago

CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on September 25, 2026: CVE-2026-65660 affecting Microsoft SharePoint (code injection) and CVE-2026-67279 impacting Mikrotik RouterOS (behavioral workflow enforcement flaw). These vulnerabilities are being actively exploited by threat actors and pose significant risks to federal enterprises and organizations worldwide. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets. This incident highlights the ongoing challenge of vulnerability management in an era where threat actors rapidly weaponize newly disclosed flaws. With SharePoint being a critical collaboration platform and RouterOS powering networking infrastructure globally, these vulnerabilities represent prime targets for initial access, lateral movement, and potential ransomware deployment campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GitHub Actions Supply Chain Attack: How Mini Shai-Hulud Malware Compromised Thousands of CI/CD Pipelines
GitHub Actions Supply Chain Attack: How Mini Shai-Hulud Malware Compromised Thousands of CI/CD Pipelines
Computer Software/Engineering1 month ago

GitHub Actions Supply Chain Attack: How Mini Shai-Hulud Malware Compromised Thousands of CI/CD Pipelines

In September 2026, two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) that were previously compromised during the Mini Shai-Hulud supply chain campaign in May 2026 were re-enabled by GitHub without cleaning up the malicious code. The threat actors had injected credential-harvesting malware into these widely-used CI/CD automation tools, which exfiltrated sensitive data to attacker-controlled servers. When the repositories came back online on September 16, 2026, any workflow referencing these actions by version tags automatically resumed downloading and executing the malicious payload, affecting numerous software projects without requiring new attacker intervention. This incident demonstrates how supply chain compromises can be reactivated without new exploits, highlighting critical gaps in repository security and code integrity verification processes. The attack showcases the persistent nature of supply chain threats where dormant malicious code can be instantly reactivated, emphasizing the urgent need for SHA pinning, comprehensive secret rotation, and robust CI/CD security practices as software development increasingly relies on third-party automation tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game
Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game
Health Care / Life Sciences1 month ago

Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game

Storm-2570, a cross-ecosystem ransomware affiliate tracked by Microsoft since April 2025, has demonstrated consistent attack patterns across multiple ransomware-as-a-service (RaaS) operations including Qilin, DragonForce, Anubis, and BERT. The threat actor has targeted organizations across 14 sectors in the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico, maintaining uniform tradecraft involving remote management tools like MeshAgent, credential harvesting utilities, and cloud exfiltration tools such as s5cmd and Rclone regardless of the final ransomware payload deployed. This case highlights the growing trend of ransomware affiliates operating independently across multiple RaaS ecosystems, shifting between operations to maximize payout opportunities. The consistent use of commodity tools and techniques across different ransomware families demonstrates how threat actors are becoming more adaptable and sophisticated in their approach to enterprise compromise.

Critical impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Macfinger ClickFix Campaign Targets macOS Users with Advanced Social Engineering
Macfinger ClickFix Campaign Targets macOS Users with Advanced Social Engineering
Computer Software/Engineering1 month ago

Macfinger ClickFix Campaign Targets macOS Users with Advanced Social Engineering

The Macfinger ClickFix campaign represents an active information stealer operation targeting macOS users through fake CAPTCHA verification pages. Discovered in September 2025, this campaign uses social engineering to trick users into executing malicious clipboard-injected text in Terminal windows, leading to the deployment of architecture-specific Mach-O binaries. The malware establishes persistence through LaunchAgents, requests extensive system permissions, and exfiltrates sensitive data including credentials, documents, and media files through HTTP POST requests and WebSocket connections to command-and-control servers. This campaign highlights the evolving threat landscape targeting macOS environments, demonstrating sophisticated social engineering techniques combined with platform-specific malware delivery methods that bypass traditional security measures through user interaction.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports