Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 4 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 37–48 / 3490 reports
Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk
Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk
Government Administration5 days ago

Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk

In November 2026, Barracuda Networks disclosed two critical vulnerabilities affecting multiple network security appliances, including its Email Security Gateway, Load Balancer ADC, Web Application Firewall, and others. CVE-2026-116606, a pre-authentication authorization bypass in the ESG, allows attackers to modify global device configurations without credentials. CVE-2026-111560 enables authenticated administrators to inject OS-level commands that execute with root privileges. When chained, the two flaws grant full device compromise. Barracuda released patches across all affected product lines and urged customers to apply firmware updates immediately while restricting administrative interface access to trusted internal networks only. This disclosure echoes Barracuda's 2023 ESG zero-day campaign (CVE-2023-2868), exploited by Chinese-nexus group UNC4841 for over seven months before discovery. The recurrence of critical appliance-level flaws in the same vendor's product line signals a broader industry pattern: network security appliances remain high-value, under-monitored targets, and organizations relying on perimeter security without internal segmentation face compounding risk.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Information Technology/IT5 days ago

Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access

In November 2026, Barracuda disclosed two chained vulnerabilities—CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass affecting the Email Security Gateway, and CVE-2026-111560 (CVSS 8.6), a command injection flaw impacting six Barracuda products including the Web Application Firewall, Load Balancer ADC, and Web Security Gateway. When exploited in sequence, an unauthenticated attacker with network access to the administrative interface can bypass authorization controls and achieve root-level code execution on the appliance. Organizations exposing administrative interfaces to the internet face the highest risk. Barracuda urged immediate firmware patching and restriction of admin interface access to trusted internal networks. This disclosure follows a well-documented pattern of nation-state and cybercriminal actors targeting network edge appliances—most notably the 2023 Barracuda ESG zero-day campaign attributed to UNC4841. Chained appliance vulnerabilities that yield root access are increasingly weaponized within days of disclosure, making rapid patch deployment and administrative interface segmentation a board-level priority in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
XCPE Botnet 2026: How 1.3 Million TV Boxes Became a Criminal Proxy Network—and What It Means for Enterprise Security
XCPE Botnet 2026: How 1.3 Million TV Boxes Became a Criminal Proxy Network—and What It Means for Enterprise Security
Consumer Electronics5 days ago

XCPE Botnet 2026: How 1.3 Million TV Boxes Became a Criminal Proxy Network—and What It Means for Enterprise Security

In November 2026, Google's Threat Intelligence Group and industry partners dismantled the XCPE botnet, a supply-chain malware operation orchestrated by Chinese TV box manufacturer Videostrong Technology Co. Over 1.3 million Android set-top boxes shipped with pre-installed backdoor malware that silently enrolled devices into residential proxy networks, enabling advertising fraud, account takeover, and anonymous criminal traffic routing. Google severed ties with Videostrong, took legal action against its command-and-control infrastructure, and coordinated with partners including Synthient to expose affiliated proxy services such as AppSalt/Honeygain, NetNut, and Grass. The takedown is estimated to sever access to more than 10 million additional compromised IoT devices globally. This incident underscores an accelerating threat trend: hardware supply-chain compromise at the manufacturer level, where malware is embedded before devices reach consumers. As IoT proliferation expands into healthcare, retail, and enterprise environments, the attack surface for botnet-as-a-service operations grows exponentially, demanding zero trust network controls and rigorous supply-chain vetting.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
Information Technology/IT5 days ago

C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now

In November 2026, Synology issued an urgent advisory after threat actors exploiting CVE-2024-10441 (CVSS 9.8) — a remote code execution flaw in DiskStation Manager patched in December 2024 — began deploying C3RB3R ransomware against NAS devices still running outdated DSM versions. The C3RB3R group, which has a documented history of targeting NAS infrastructure, encrypted victim files with a .L0CK3D extension and dropped ransom notes in every affected directory. Attackers also leveraged two newly disclosed 2026 DSM vulnerabilities (CVE-2026-13684 and CVE-2026-13639, both CVSS 9.8) affecting SCGI and login logic, enabling arbitrary file read/write and denial-of-service. Synology urged immediate patching and activation of automatic updates across all affected DSM branches. This incident underscores a persistent and escalating pattern: ransomware operators are increasingly targeting unpatched network-attached storage devices as primary encryption targets, exploiting months-old CVEs that organizations fail to remediate. With NAS devices frequently storing backup and archival data, successful encryption dramatically elevates recovery costs and operational disruption, amplifying ransom leverage.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
Information Technology/IT5 days ago

CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit

In November 2026, Red Hat and Canonical disclosed CVE-2026-98432, a critical use-after-free vulnerability (CVSS 9.8) in the Linux kernel's IPv4 TCP stack present since kernel version 4.4. A remote, unauthenticated attacker can trigger a race condition by sending IPv4 TCP connection requests carrying Record Route or Timestamp IP options to any listening TCP port, potentially achieving remote code execution without credentials or user interaction. Red Hat shipped emergency errata for RHEL 8, 9, and 10 on November 1, 2026, while Ubuntu's fixes for its three current LTS releases remain in an opt-in testing channel. Anthropic disclosed that an internal AI research model independently developed a working remote root exploit requiring no credentials, with full root shell access achievable in under one hour. This incident underscores the accelerating intersection of AI-assisted exploit development and unpatched Linux infrastructure. As AI models demonstrate the capacity to autonomously construct kernel-level exploits, the window between vulnerability disclosure and weaponization is collapsing, demanding near-real-time patch cadence and compensating network controls across cloud and hybrid environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet
Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet
Consumer Electronics5 days ago

Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet

In 2025, Google's Threat Intelligence Group dismantled XCPE, a large-scale botnet deliberately embedded by Chinese Android OEM Videostrong Technology Co. into more than 1.3 million certified TV set-top boxes and other Android devices sold across 170 countries. Videostrong bypassed Google's security certification process by loading malicious backdoor code after the device's first boot, allowing XCPE operators to conduct ad fraud, data exfiltration, and residential proxy abuse for years undetected. Google took legal action to seize command-and-control domains, banned Videostrong from the Android ecosystem, and partnered with law enforcement and industry peers to disrupt over a dozen affiliated malware families impacting an estimated 10 million additional devices. This incident exposes a systemic vulnerability in hardware supply chains where trusted certification processes can be subverted by malicious insiders at the manufacturer level. As enterprises increasingly deploy IoT and edge devices at scale, the risk of pre-compromised hardware entering corporate and consumer environments demands rigorous supply-chain vetting, firmware integrity verification, and network-layer behavioral monitoring that extends beyond traditional endpoint controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways
Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways
Information Technology/IT6 days ago

Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways

Beginning at least October 1, 2026, a threat actor tracked as UTA0576 chained three Ivanti Connect Secure zero-day vulnerabilities—an authentication bypass (CVE-2026-104935), a privilege escalation flaw (CVE-2026-111357), and a file-upload weakness (CVE-2026-118527)—to achieve unauthenticated root-level code execution on fully patched gateway appliances. The attacker avoided deploying malware or web shells, instead re-exploiting the device for each command and actively tampering with logs to evade Ivanti's Integrity Checker Tool. With over 5,000 ICS instances exposed to the internet, CISA issued an emergency directive ordering federal agencies to patch by end of week. Ivanti has now released fixes for all three CVEs. This incident reinforces a persistent pattern: enterprise VPN and remote-access gateways remain primary targets for nation-state and sophisticated threat actors. The chaining of authentication bypass, privilege escalation, and file-upload vulnerabilities for fileless, log-evading intrusions signals a maturation of living-off-the-land techniques against network perimeter appliances, demanding zero-trust network segmentation beyond traditional perimeter controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
Information Technology/IT6 days ago

C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know

In late October 2026, Synology issued an urgent advisory warning customers that threat actors were actively exploiting a critical remote-code-execution vulnerability (CVE-2024-10441, patched December 2024) in unpatched DiskStation Manager (DSM) software to deploy C3RB3R ransomware against internet-exposed NAS devices. Attackers encrypted victim data and appended a .L0CK3D extension, then demanded thousands of dollars for a decryption tool sold via a dark-web portal. With Shadowserver tracking over 380,000 internet-facing Synology NAS devices, the attack surface is substantial, and user reports on Reddit and BleepingComputer forums confirmed widespread infections well before Synology's formal advisory. C3RB3R (also called CerberImposter) has a documented history of pivoting from enterprise servers—Atlassian Confluence and GitLab—to edge storage appliances, demonstrating ransomware operators' strategy of targeting high-value, often-neglected network perimeter devices. The campaign underscores how unpatched NAS gear exposed directly to the internet continues to be a reliable ransomware entry point, elevating urgency for patch discipline and perimeter access controls across all industries.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch
1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch
Computer Software/Engineering6 days ago

1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch

In late October 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a maximum-severity integer overflow flaw in GitLab's CI/CD Regular Expression Compiler. The vulnerability allows unauthenticated attackers to execute arbitrary code on unpatched self-managed GitLab instances by submitting a specially crafted regular expression via pipeline configuration files. GitLab issued patches on October 12, 2026 across CE and EE versions 19.4.2, 19.3.5, and 19.2.8, yet Shadowserver reported over 1,000 internet-exposed servers remained unpatched as of early November, with 11,300 additional instances still vulnerable to a related RCE flaw (CVE-2026-110264). This incident underscores a persistent and dangerous pattern: critical patches for widely used DevSecOps platforms go undeployed for weeks, leaving CI/CD pipelines — the backbone of software supply chains at Fortune 100 companies and beyond — exposed to unauthenticated remote code execution. With GitLab serving over 70 million users, the blast radius of delayed patching is enormous and continues to grow as active exploitation campaigns intensify.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices
Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices
Consumer Electronics6 days ago

Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices

In late October 2026, Google led a coordinated takedown of the XCPE botnet, a supply-chain-embedded operation infecting over 1.3 million Android TV set-top boxes and other consumer devices with a firmware-level backdoor. Device manufacturer Videostrong, based in Shenzhen, China, intentionally embedded the x.cpe backdoor into firmware across hundreds of models and sold criminal access. Operators disabled Google Play Protect, silently installed modules, harvested credentials, opened reverse shells, and monetized devices as residential proxies and ad-fraud engines. Google banned Videostrong from the Android ecosystem and partnered with Japan's NPA, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to seize C2 infrastructure across more than a dozen malware families, with downstream impact estimated at 10 million additional devices. This incident marks a critical escalation in supply-chain weaponization, where hardware manufacturers themselves serve as the threat actor. As enterprise networks increasingly absorb unmanaged consumer and IoT devices—especially through remote-work hybrid environments—firmware-embedded backdoors bypassing platform security checks represent a systemic risk that perimeter and endpoint controls alone cannot address.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
Financial Services6 days ago

VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026

In November 2026, Cisco Talos researchers disclosed VOLTA-AUTODOXER (VOLTA), a novel Windows infostealer that harvests credentials, cookies, payment cards, cryptocurrency seeds, OAuth tokens, SSH keys, and session data from compromised endpoints. What distinguishes VOLTA from commodity stealers is its embedded AI triage layer: stolen data is serialized into a structured evidence bundle and routed through OpenRouter to Anthropic Claude Opus 4.6, with fallbacks to Moonshot AI Kimi K2 and Google Gemini 2.5 Flash. The AI generates a monetization-ranked dossier and victim OPSEC assessment, then exfiltrates all output to a Telegram channel across three staged drops, effectively automating the analyst function for low-sophistication threat operators. VOLTA signals a structural shift in the infostealer economy: generative AI is no longer a research curiosity but an operationalized feature in commoditized malware builders. As adversarial GenAI adoption accelerates, security teams face a narrowing detection window because AI-assisted triage collapses the offline processing delay that historically gave defenders time to act after initial compromise.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
Information Technology/IT6 days ago

How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise

In late 2026, Microsoft investigated two intrusions in which attackers impersonated IT help desk staff via Microsoft Teams, convincing employees to grant remote access through Windows Quick Assist. The threat actors then exploited misconfigured Active Directory Certificate Services (AD CS) — specifically ESC1 and ESC8 vulnerabilities disclosed in 2021 — to obtain authentication certificates for privileged accounts, including domain controllers. In the first case, a single privileged account excluded from automatic containment allowed the attacker to reach a file server and exfiltrate data to an external SFTP server using a renamed Rclone binary. The second case was contained after workstation isolation. These intrusions underscore a dangerous convergence of social engineering, identity-based persistence, and misconfigured PKI infrastructure. As organizations accelerate cloud adoption and hybrid work, AD CS misconfigurations remain widespread, and Teams-based impersonation continues to scale — making identity hygiene and certificate auditing critical defensive priorities heading into 2027.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports