Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 43 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 505–516 / 3490 reports
GitLab's CVSS 10.0 Vulnerability: Why DevOps Security Can't Wait
GitLab's CVSS 10.0 Vulnerability: Why DevOps Security Can't Wait
Computer Software/Engineering1 month ago

GitLab's CVSS 10.0 Vulnerability: Why DevOps Security Can't Wait

GitLab disclosed a critical path traversal vulnerability (CVE-2026-85706) with a maximum CVSS score of 10.0, allowing unauthenticated attackers to read arbitrary files from GitLab servers through the repository commits API. The flaw affects GitLab CE and EE versions from 18.7 through 19.3.1, stemming from improper path confinement and missing authentication enforcement. Within hours of public disclosure on September 11, 2026, security researchers observed active in-the-wild exploitation attempts targeting exposed GitLab instances to extract log files, configuration data, credentials, and sensitive information. This incident highlights the accelerating timeline from vulnerability disclosure to active exploitation, particularly for DevOps platforms that house critical source code and CI/CD secrets. Following a similar pattern to the recent GitLab GraphQL injection vulnerability (CVE-2026-19478), attackers are rapidly weaponizing these flaws to compromise software supply chains and inject malicious code into build pipelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine
UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine
Health Care / Life Sciences1 month ago

UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine

In September 2026, Russia-aligned threat group UAC-0099 deployed a novel AI manipulation technique called GuardBreaker against Ukrainian targets. The attackers embedded nuclear weapon prompts within malicious VBScript comments to trigger AI safety mechanisms and prevent automated malware analysis systems from examining their code. This represents a significant evolution in adversarial tactics, where threat actors manipulate AI defensive reasoning rather than increasing malware sophistication to achieve compromise. This incident highlights the accelerating arms race between AI-powered security tools and adversaries who exploit their limitations. With AI systems now discovering vulnerabilities at unprecedented speed and scale, traditional 90-day patch cycles are obsolete, creating an urgent need for multilayered defense strategies that don't rely solely on AI-based detection mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer
The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer
Financial Services1 month ago

The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer

AI-enabled social engineering attacks have reached unprecedented sophistication, with cybercriminals leveraging large language models to create highly personalized and emotionally manipulative scams. Research by Fred Heiding of Menlo Park Intelligence reveals that AI systems excel at human manipulation through voice cloning, long-term relationship building, and cultural context adaptation. The FBI's Internet Crime Center reports that fraud losses skyrocketed from $4 billion in 2020 to $21 billion in 2025, primarily targeting vulnerable populations including senior citizens who develop emotional dependencies on AI-powered scam bots. This asymmetric threat landscape highlights a critical security gap where traditional technical defenses prove inadequate against AI-enhanced social engineering, as human cognitive vulnerabilities cannot be patched like software systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
The PaperCut AI Swarm Attack: When Machines Wage Cyber Warfare
The PaperCut AI Swarm Attack: When Machines Wage Cyber Warfare
Computer Software/Engineering1 month ago

The PaperCut AI Swarm Attack: When Machines Wage Cyber Warfare

In August 2026, a Russian-speaking threat actor deployed hundreds of AI agents in a coordinated swarm attack targeting PaperCut NG and MF print management software. The AI-powered campaign compromised at least 440 instances across 395 organizations in 48 countries, achieving remote code execution within four hours and Active Directory domain admin access in just six hours total. Once fully launched, the swarm compromised 11 organizations in merely 26 seconds, demonstrating unprecedented speed and scale in automated cyberattacks. This incident represents a critical inflection point where AI agents are now actively integrated across the entire cyber kill chain, from reconnaissance to exfiltration. As nation-state actors and financially motivated groups increasingly weaponize large language models and agentic AI capabilities, organizations face a new reality where attackers can execute complex, multi-stage operations at machine speed while defenders still operate at human pace.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
How Storm-3032 and Storm-3121 Are Exploiting BYOD Policies to Breach Corporate Microsoft 365
How Storm-3032 and Storm-3121 Are Exploiting BYOD Policies to Breach Corporate Microsoft 365
Financial Services1 month ago

How Storm-3032 and Storm-3121 Are Exploiting BYOD Policies to Breach Corporate Microsoft 365

Since May 2026, Microsoft researchers have tracked threat actors Storm-3032 and Storm-3121 conducting sophisticated initial access campaigns targeting corporate executives through their personal devices. The attackers use voice calls and text messages impersonating IT helpdesks to trick employees into updating authentication credentials via phishing links. Once access is gained, the threat actors exploit Microsoft Graph API to enumerate corporate resources and exfiltrate sensitive data from SharePoint, OneDrive, and Exchange before potentially selling access to extortion groups like ShinyHunters. This campaign highlights the growing trend of attackers bypassing corporate security controls by targeting the weakest link - personal devices with minimal security protections. As organizations increasingly adopt BYOD policies and hybrid work models, identity-based attacks exploiting trusted communication channels represent a critical evolution in threat actor tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How Cisco FMC Vulnerabilities Enabled Qilin Ransomware Deployment
How Cisco FMC Vulnerabilities Enabled Qilin Ransomware Deployment
Computer/Network Security1 month ago

How Cisco FMC Vulnerabilities Enabled Qilin Ransomware Deployment

In September 2026, Cisco revealed that three distinct threat clusters exploited critical vulnerabilities CVE-2026-20079 and CVE-2026-20316 in Cisco Secure Firewall Management Center (FMC) systems. The attacks involved state-sponsored groups and ransomware operators who leveraged these flaws to deploy web shells, steal credentials, conduct reconnaissance, and ultimately deploy Qilin ransomware. The exploitation allowed attackers to bypass authentication, gain root access, and perform living-off-the-land techniques using legitimate FMC tools to avoid detection while moving laterally through victim networks. This incident highlights the growing trend of threat actors targeting network security infrastructure as initial access vectors, demonstrating how critical security appliances themselves become single points of failure when unpatched vulnerabilities exist.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Four Critical Infrastructure Vulnerabilities to KEV Catalog
CISA Adds Four Critical Infrastructure Vulnerabilities to KEV Catalog
Government Administration1 month ago

CISA Adds Four Critical Infrastructure Vulnerabilities to KEV Catalog

In September 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities affect widely deployed enterprise infrastructure including Fortinet security appliances (CVE-2025-25249 heap-based buffer overflow), Citrix NetScaler (CVE-2026-19490 authentication bypass), Google Chromium V8 engine (CVE-2026-87491 out-of-bounds write), and Cisco Firewall Management Center (CVE-2026-20079 authentication bypass). These vulnerabilities pose significant risks as they target critical network security infrastructure and web browsers used across federal and private sector environments. This incident highlights the ongoing threat landscape where attackers systematically target network security appliances and widely-used software components to establish persistent access and bypass security controls, reflecting the continued evolution of threat actor tactics toward infrastructure-level compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical MikroTik RouterOS Vulnerabilities Added to CISA KEV Catalog: Immediate Action Required
Critical MikroTik RouterOS Vulnerabilities Added to CISA KEV Catalog: Immediate Action Required
Telecommunications1 month ago

Critical MikroTik RouterOS Vulnerabilities Added to CISA KEV Catalog: Immediate Action Required

CISA added two critical MikroTik RouterOS vulnerabilities (CVE-2026-67277 and CVE-2026-86060) to its Known Exploited Vulnerabilities (KEV) Catalog in September 2026 following evidence of active exploitation. CVE-2026-67277 involves missing authentication for critical functions, while CVE-2026-86060 relates to improper neutralization of argument delimiters in commands. These vulnerabilities affect network infrastructure devices and allow attackers to gain total control of compromised systems, posing significant risks to federal and enterprise networks. This addition reinforces the critical importance of rapid vulnerability remediation as network infrastructure attacks continue to surge, with threat actors increasingly targeting edge devices and routers to establish persistent footholds for lateral movement and data exfiltration campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-3075 and AI-Themed Phishing: The New Frontier of Social Engineering
Storm-3075 and AI-Themed Phishing: The New Frontier of Social Engineering
Financial Services1 month ago

Storm-3075 and AI-Themed Phishing: The New Frontier of Social Engineering

Throughout 2026, cybercriminals increasingly exploited AI brand trust through sophisticated phishing campaigns targeting popular platforms like ChatGPT, Microsoft Copilot, DeepSeek, and Claude. Microsoft Threat Intelligence documented massive campaigns including a ChatGPT-themed operation sending 100,000 phishing emails daily to harvest credit card data, Claude-themed credential theft using adversary-in-the-middle techniques, and malvertising campaigns distributing Vidar stealer through fake AI Windows plugins. Storm-3075, an initial access broker, commoditized AI-themed malvertising across criminal networks, demonstrating the rapid scaling of these attacks. This trend reflects the broader evolution of social engineering attacks exploiting emerging technology hype cycles, with AI brands carrying significant trust and curiosity that attackers leverage to bypass traditional security awareness. The campaigns represent a paradigm shift from isolated phishing attempts to multi-stage attack chains spanning email, web, identity, and endpoint domains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution
Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution
Government Administration1 month ago

Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution

Ukrainian national Oleksii Lytvynenko was sentenced to four years in prison for his role in the Conti ransomware group, which attacked over 1,000 organizations globally before disbanding in 2022. Lytvynenko joined the prolific cybercrime operation in September 2021, developing malware and holding data from 12 victims including eight U.S.-based organizations. The group extorted approximately $634,000 in Bitcoin from victims in Tennessee, including a government entity that resulted in compromised sheriff's department, emergency medical services, and police department systems. This sentencing represents continued law enforcement efforts to prosecute ransomware operators despite their overseas operations, as Conti members have since rebranded under multiple successor groups including Black Basta, Royal, and BlackSuit, maintaining the threat landscape's evolution and persistence of ransomware-as-a-service operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ransomware Gangs Target WatchGuard Firebox Vulnerability: 9,000 Devices Still at Risk
Ransomware Gangs Target WatchGuard Firebox Vulnerability: 9,000 Devices Still at Risk
Financial Services1 month ago

Ransomware Gangs Target WatchGuard Firebox Vulnerability: 9,000 Devices Still at Risk

CISA confirmed that ransomware gangs are actively exploiting CVE-2025-14733, a critical remote code execution vulnerability in WatchGuard Firebox firewalls. The flaw, first disclosed in December 2025, stems from an out-of-bounds write vulnerability affecting firewalls with IKEv2 VPN configurations. Despite patches being available for nine months, nearly 9,000 vulnerable devices remain exposed online according to Shadowserver monitoring, down from an initial 115,000. The vulnerability allows unauthenticated attackers to execute malicious code remotely with low complexity, making it an attractive target for threat actors. This incident highlights the persistent challenge of network perimeter security in an era where traditional firewalls face sophisticated exploitation techniques. With WatchGuard serving over 250,000 organizations through 17,000 resellers globally, the widespread exposure of this vulnerability demonstrates how legacy security infrastructure becomes a liability when not properly maintained and patched.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security
IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security
Financial Services1 month ago

IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security

In September 2026, identity verification company IDScan confirmed a significant data breach affecting over 153 million driver's license scans and personal identification documents. Threat actors gained unauthorized access to IDScan's cloud platform, compromising customer data including full names, driver's license numbers, and scanned copies of government-issued IDs. The stolen data was subsequently advertised on a dark web platform called 'Nexus' before being taken offline following FBI investigation. IDScan provides identity verification services to car rental companies, financial institutions, cannabis dispensaries, and hospitality businesses across the US and Canada. This incident highlights the growing threat to identity verification infrastructure as cybercriminals increasingly target centralized repositories of sensitive personal data. The breach demonstrates how third-party service providers handling critical identity documents have become high-value targets, creating cascading privacy risks across multiple industries that rely on these verification services.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports