Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 50 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 589–600 / 3490 reports
AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining
AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining
Financial Services2 months ago

AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining

AWS released a comprehensive incident response guide demonstrating two critical attack scenarios affecting cloud environments in 2025. The first scenario involves a cross-account S3 data deletion attack where threat actors assumed roles from trusted accounts, performed reconnaissance through ListBuckets operations, and executed scripted deletions of financial reports, PII databases, and production backups within a 13-second window. The second scenario showcases cryptocurrency mining operations deployed through AWS CloudFormation, where attackers leveraged console credentials without MFA to create the 'CRYPTO' stack containing EC2 instances for mining operations. Both incidents highlight the sophistication of modern cloud-native attacks that exploit legitimate AWS services and cross-account trust relationships. These attack patterns are increasingly relevant as organizations accelerate cloud adoption while struggling with proper access controls, zero trust implementation, and multi-cloud visibility. The incidents underscore the critical need for enhanced CloudTrail monitoring, cross-account access reviews, and comprehensive egress security policies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access
Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access
Financial Services2 months ago

Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access

A sophisticated multi-stage attack demonstrated how web application vulnerabilities can cascade into unauthorized AI service access across AWS regions. The incident began with a Server-Side Request Forgery (SSRF) vulnerability in a web application that allowed attackers to exploit IMDSv1 endpoints and harvest temporary AWS credentials from an EC2 instance's webdev role. Using these compromised credentials, the threat actor conducted permission boundary testing, established console access without MFA, and ultimately pivoted to Amazon Bedrock services across multiple regions, successfully invoking AI models and consuming computational resources. This attack chain highlights critical gaps in cloud security architecture, particularly the dangerous combination of overprivileged IAM roles, legacy metadata service configurations, and inconsistent cross-region security controls that enabled lateral movement from a simple web vulnerability to unauthorized AI infrastructure access.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected
The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected
Computer Software/Engineering2 months ago

The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected

New research from Echo analyzing nearly 40,000 CVE lifecycles reveals that while AI tools like Anthropic's Claude Mythos have dramatically accelerated vulnerability discovery, the anticipated 'Vulnpocalypse' may be more manageable than feared. Monthly CVE disclosures surged 145% from June 2024 to June 2026, rising from 3,173 to 7,765, with AI enabling exploit development in under one day for less than $2,000. However, fewer than 10% of AI-discovered vulnerabilities receive external validation, and most critical ratings are downgraded upon review. The study found that 89% of examined vulnerabilities already have fixes available, but 40% remain unpatched for over six months due to deployment challenges rather than fix availability. Organizations can better manage this surge by focusing on rapid validation, intelligent prioritization, and automated remediation processes rather than completely overhauling their vulnerability management programs.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
Health Care / Life Sciences2 months ago

The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers

In 2026, artificial intelligence is fundamentally transforming the cybercrime landscape by dramatically compressing attack timelines and lowering entry barriers for threat actors. Former cybercriminal Brett Johnson, known as the 'original Internet Godfather' by the US Secret Service, demonstrated at Black Hat USA how AI enables attackers to conduct reconnaissance, identify crown jewels, and execute attacks in significantly reduced timeframes. While defenders still operate reactively, AI empowers criminals to automate target research, vulnerability discovery, and even ransomware development without requiring advanced technical skills. This shift is driving more attackers toward critical infrastructure targets like hospitals and schools, where higher payouts justify the risks. The technology's learning-based nature means it benefits attackers more than defenders, as it must observe successful attacks to improve, creating an inherent advantage for malicious actors in the current threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
Financial Services2 months ago

Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549

In September 2026, attackers began actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 perimeter devices, enabling unauthenticated remote code execution. CVE-2026-83548, a critical SSRF vulnerability with a CVSS score of 10.0, allows unauthorized access through an unintended alternate access path, while CVE-2026-83549 enables OS command injection. When chained together, these flaws provide complete system compromise of affected appliances running versions 12.4.3-03453/12.5.0-02835 and older. SonicWall confirmed ongoing exploitation and urged immediate patching to versions 12.4.3-03526/12.5.0-02952 or higher. This incident highlights the continued targeting of edge security devices as initial compromise vectors, following a pattern of sophisticated zero-day attacks against network perimeter appliances throughout 2026, emphasizing the critical need for rapid patch management and network segmentation strategies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours
Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours
Computer Software/Engineering2 months ago

Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours

In September 2026, threat actors demonstrated the devastating potential of AI-assisted cyberattacks by compressing a typical two-week enterprise breach timeline into just 10 hours. The attackers deployed coordinated frontier AI agents that autonomously breached network security layers, harvested credentials, seized root access, hijacked CI/CD pipelines, and weaponized the victim's own AI infrastructure. The attack began with exploitation of a public API endpoint and escalated through systematic extraction of hardcoded tokens from code repositories, ultimately providing master administrative credentials and complete system compromise. This machine-speed ransomware attack represents a paradigm shift from individual AI-assisted tasks to orchestrated multi-agent operations that can outpace traditional security response capabilities. The emergence of AI-driven attack coordination signals a new era where threat actors can achieve enterprise-scale breaches with unprecedented speed and efficiency, forcing organizations to fundamentally reimagine their defense strategies and response timelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
Information Technology/IT2 months ago

Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target

CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026 after observing active exploitation by threat actors. The vulnerabilities span multiple platforms including SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, and AI infrastructure components like LiteLLM and Kestra. Attackers exploited these flaws to deploy reverse shells, cryptocurrency miners, and conduct unauthorized operations, with campaigns targeting AI infrastructure becoming increasingly prominent as adversaries seek to harvest API keys and monetize compromised systems. This incident highlights the growing threat landscape targeting AI infrastructure and the critical importance of rapid vulnerability remediation. With AI systems becoming prime targets for credential theft and resource hijacking, organizations must prioritize security updates and implement comprehensive monitoring across their AI workloads to prevent similar exploitation campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector
FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector
Computer/Network Security2 months ago

FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector

In September 2026, security researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation exploit targeting CrowdStrike Falcon endpoint security software. The vulnerability abuses office malicious macros remediation functionality within Falcon Sensor to achieve privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 systems. This disclosure follows the researcher's pattern of releasing proof-of-concept exploits for major endpoint security products, including recent vulnerabilities in Kaspersky and Microsoft Defender, highlighting systemic weaknesses in endpoint protection platforms. This incident underscores the growing trend of security researchers targeting endpoint detection and response (EDR) solutions themselves, exposing critical trust assumptions in enterprise security architectures and forcing organizations to reconsider their defense-in-depth strategies.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains
Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains
Computer Software/Engineering2 months ago

Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains

In August 2026, GitGuardian researchers discovered that the Shai-Hulud infostealer worm had evolved to scan for credentials across 469 locations in developer environments, representing a 148% increase from earlier variants that checked only 189 paths. The malware targets CI/CD tooling, cloud configurations, AI tool configs, package registries, and development environments to harvest reusable credentials for supply chain attacks. The stolen credentials enable lateral movement across trusted software supply chains, turning credential theft into ongoing propagation vectors through package publishing systems. This incident highlights the critical shift in attack methodologies where threat actors no longer need to break trust relationships but instead exploit existing credential sprawl across modern development ecosystems. The exponential increase in targeted credential locations demonstrates the growing sophistication of supply chain attacks and the urgent need for comprehensive secrets management across DevOps pipelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access
Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access
Information Technology/IT2 months ago

Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access

Microsoft Threat Intelligence discovered a sophisticated social engineering campaign where threat actors impersonate IT support personnel through Microsoft Teams external collaboration to trick users into granting remote access. Once control is established via legitimate remote management tools, attackers deploy a malicious MSI package that stages a Node.js runtime and JavaScript implant for persistent command execution. The campaign progresses through extensive reconnaissance, Active Directory enumeration, and lateral movement via Windows Remote Management (WinRM) toward high-value assets including domain controllers, representing a precursor to ransomware deployment or data theft operations. This attack pattern demonstrates the evolving threat landscape where attackers leverage trusted enterprise collaboration platforms and legitimate administrative tools to bypass traditional security controls. The shift from commodity phishing to hands-on-keyboard operations targeting identity infrastructure reflects the increasing sophistication of modern threat actors seeking enterprise-wide access for high-impact cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SANS Honeypot Captures Massive Automated Credential Attack Campaign
SANS Honeypot Captures Massive Automated Credential Attack Campaign
Computer/Network Security2 months ago

SANS Honeypot Captures Massive Automated Credential Attack Campaign

The SANS Internet Storm Center's Honeypot-Omaha deployment captured extensive automated credential attack campaigns targeting SSH and Telnet services. Threat actors from IP addresses associated with PPTECHNOLOGY LIMITED and other providers executed systematic brute-force attacks, successfully compromising honeypot systems through weak credentials. Once gaining access, attackers performed reconnaissance, system enumeration, and data exfiltration while attempting to cover their tracks using commands like 'rm -rf filter'. The analysis revealed over 400 file artifacts and multiple attack sessions showing coordinated botnet-style automation targeting vulnerable internet-facing services. This incident highlights the persistent threat landscape facing organizations with exposed SSH and Telnet services, demonstrating how attackers leverage automated tools and compromised infrastructure to systematically target weak authentication mechanisms across internet-connected systems.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC
Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC
Information Technology/IT2 months ago

Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC

In June 2026, NetSPI security researchers discovered a critical privilege escalation vulnerability in Microsoft Azure's Role-Based Access Control (RBAC) system. The vulnerability existed in the built-in 'Anyscale Platform Administrator Role' which contained unconstrained Microsoft.Authorization/roleAssignments/write permissions, allowing arbitrary escalation to Owner-level privileges without proper Attribute-Based Access Control (ABAC) restrictions. This finding highlighted broader security gaps in Azure's rapidly expanding attack surface, which now includes over 200 services, 897 built-in RBAC roles, and 22,018 different permissions. Microsoft addressed the issue within two weeks of disclosure by removing the problematic permissions from the affected role. This incident represents a critical trend in cloud security as organizations increasingly rely on complex cloud permission models that can contain hidden escalation paths, emphasizing the urgent need for granular permission auditing and zero-trust access controls in multi-cloud environments.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports