Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 61 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 721–732 / 3490 reports
Critical GitLab Vulnerability CVE-2026-19478: Immediate Action Required
Computer Software/Engineering2 months ago

Critical GitLab Vulnerability CVE-2026-19478: Immediate Action Required

In August 2026, GitLab disclosed a critical vulnerability (CVE-2026-19478) in its Community and Enterprise Editions, affecting versions from 18.2 up to 19.2.3. This code injection flaw within the GraphQL API allows unauthenticated attackers to remotely modify or delete public projects and user data. The vulnerability has been assigned a CVSS score of 9.4 due to its high impact on data integrity and availability. Organizations using self-managed GitLab instances are urged to upgrade to the patched versions 18.11.11, 19.0.8, 19.1.6, or 19.2.4 immediately to mitigate this risk. The disclosure of CVE-2026-19478 underscores the critical importance of securing APIs against unauthorized access and code injection attacks. As threat actors increasingly exploit such vulnerabilities, organizations must prioritize timely patching and implement robust monitoring of API activities to detect and prevent unauthorized operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in macOS, SharePoint, vCenter, and IKE Under Active Exploitation
Information Technology/IT2 months ago

Critical Vulnerabilities in macOS, SharePoint, vCenter, and IKE Under Active Exploitation

In August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. These vulnerabilities include CVE-2026-65400 affecting Apple macOS, CVE-2026-55040 in Microsoft SharePoint, CVE-2026-59310 in VMware vCenter, and CVE-2026-33824 in Microsoft Internet Key Exchange (IKE) Service Extensions. Exploitation of these flaws has led to unauthorized access, deployment of cryptocurrency miners, backdoors, and ransomware attacks across multiple countries. The active exploitation of these vulnerabilities underscores the persistent threat posed by sophisticated cyber actors targeting widely used enterprise systems. Organizations are urged to prioritize patching and implement robust security measures to mitigate potential risks associated with these exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft Uncovers Extensive MacSync Stealer Infrastructure
Information Technology/IT2 months ago

Microsoft Uncovers Extensive MacSync Stealer Infrastructure

In August 2026, Microsoft Defender Experts identified over 30 web domains associated with MacSync Stealer, a macOS-targeted information-stealing malware. The investigation revealed that the malware utilized social engineering tactics, such as ClickFix, to trick users into executing malicious commands in the Terminal. Once executed, MacSync Stealer collected sensitive data, including macOS Keychain contents, browser credentials, SSH keys, and AWS credentials, which were then exfiltrated to attacker-controlled servers. The malware employed various evasion techniques, including in-memory execution and the use of native macOS utilities, to minimize detection. This incident underscores the evolving sophistication of macOS-targeted malware and the increasing use of social engineering techniques to bypass traditional security measures. Organizations must remain vigilant and educate users about the risks of executing unverified commands, especially as threat actors continue to adapt their methods to exploit human factors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Arup's $25 Million Deepfake Scam: A Wake-Up Call for Cybersecurity
Financial Services2 months ago

Arup's $25 Million Deepfake Scam: A Wake-Up Call for Cybersecurity

In January 2024, a finance employee at Arup's Hong Kong office received an email, purportedly from the company's UK-based CFO, requesting a confidential transaction. To verify, the employee joined a video conference with individuals appearing as the CFO and other senior colleagues. Convinced by the authenticity of the participants, the employee executed 15 wire transfers totaling approximately $25.6 million to designated bank accounts. Subsequent investigations revealed that the video call participants were AI-generated deepfakes, and the entire scenario was orchestrated by cybercriminals. This incident underscores the evolving sophistication of cyber threats, where attackers leverage advanced AI technologies to create highly convincing social engineering schemes. Organizations must recognize that traditional verification methods, such as visual and auditory confirmation, can be compromised. Implementing multi-factor authentication, establishing robust verification protocols, and educating employees about emerging threats are crucial steps in mitigating such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Medusa Ransomware's Rapid Expansion: A 2026 Update
Health Care / Life Sciences2 months ago

Medusa Ransomware's Rapid Expansion: A 2026 Update

In August 2026, the Medusa ransomware-as-a-service group expanded its operations, adding over 200 new victims within a year, totaling more than 500 since its identification in 2021. The group exploits unpatched software vulnerabilities, including Fortra GoAnywhere and BeyondTrust flaws, and employs access brokers to gain initial access, paying between $100 to $1 million. Medusa actors utilize legitimate tools and 'living off the land' techniques to evade detection, leveraging remote monitoring and management software and Remote Desktop Protocol for lateral movement. Once inside a network, they use common utilities to support credential access, data exfiltration, and ransomware deployment. This incident underscores the critical need for organizations to promptly patch software vulnerabilities and implement robust access controls. The healthcare and public health sectors have been frequent targets, highlighting the importance of securing sensitive data against opportunistic ransomware attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Alerts on Ransomware Exploitation of Windows Task Host Vulnerability CVE-2025-60710
Government Administration2 months ago

CISA Alerts on Ransomware Exploitation of Windows Task Host Vulnerability CVE-2025-60710

In November 2025, Microsoft patched a high-severity privilege escalation vulnerability, CVE-2025-60710, in the Windows Task Host component, which affects Windows 11 and Windows Server 2025 systems. This flaw allows local attackers with basic user permissions to gain SYSTEM-level access by exploiting improper link resolution before file access. Despite the availability of patches, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed in April 2026 that this vulnerability was being actively exploited. By August 2026, CISA reported that ransomware gangs were leveraging CVE-2025-60710 to escalate privileges and deploy ransomware on unpatched systems, posing significant risks to organizations relying on these Windows versions. This incident underscores the critical importance of timely patch management and proactive vulnerability mitigation strategies to prevent exploitation by threat actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Bridging the Gap: Enhancing Cybersecurity with Behavioral Detection
Financial Services2 months ago

Bridging the Gap: Enhancing Cybersecurity with Behavioral Detection

In August 2026, Picus Security's Blue Report highlighted a significant gap in cybersecurity defenses: while perimeter controls effectively block known attack signatures, they often fail to detect subtle variations of the same techniques. For instance, the tool Mimikatz, when used to dump credentials via less conspicuous methods, bypassed defenses in 97% of cases. This underscores the need for security measures that focus on attacker behaviors, not just known indicators of compromise. This finding is crucial as adversaries increasingly employ stealthy tactics to evade detection. Organizations must adopt behavioral-based detection strategies to address these evolving threats and enhance their overall security posture.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Exploits Target MLflow and FUXA Vulnerabilities in August 2026
Information Technology/IT2 months ago

Critical Exploits Target MLflow and FUXA Vulnerabilities in August 2026

In August 2026, two critical vulnerabilities were actively exploited: CVE-2026-64849 in MLflow and CVE-2026-25895 in FUXA. The MLflow vulnerability allowed unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks, enabling access to internal cloud metadata endpoints and extraction of sensitive data. The FUXA vulnerability permitted unauthenticated remote attackers to write arbitrary files to the server filesystem, potentially leading to remote code execution. Both vulnerabilities were promptly patched in subsequent software releases. The exploitation of these vulnerabilities underscores the persistent targeting of open-source platforms by threat actors. Organizations are urged to prioritize timely patching, conduct thorough audits for signs of compromise, and implement robust security measures to protect against similar threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(low)
Read report
Microsoft Copilot Personal's CoSnitch Vulnerability: A Critical Security Flaw Exposed
Computer Software/Engineering2 months ago

Microsoft Copilot Personal's CoSnitch Vulnerability: A Critical Security Flaw Exposed

In August 2026, Varonis Threat Labs disclosed a critical vulnerability in Microsoft Copilot Personal, dubbed 'CoSnitch' (CVE-2026-24301). This flaw allowed attackers to execute malicious prompts within a user's authenticated session by exploiting an undocumented URL parameter, 'autorun=1'. By crafting a specific link, attackers could trigger Copilot to run unauthorized commands, leading to the exfiltration of sensitive data from connected applications without user interaction. Microsoft addressed this vulnerability with a patch released on August 18, 2026. The CoSnitch vulnerability underscores the evolving risks associated with AI-driven platforms and the importance of rigorous security assessments. As AI assistants become more integrated into daily workflows, ensuring their security against novel attack vectors is paramount to protect user data and maintain trust in these technologies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling PurpleDelta: The Sophisticated Fraudulent Employment Operation
Computer Software/Engineering2 months ago

Unveiling PurpleDelta: The Sophisticated Fraudulent Employment Operation

Between late 2024 and early 2025, Recorded Future's Insikt Group identified multiple clusters of activity linked to 'PurpleDelta,' a designation for North Korean IT workers operating under fabricated personas. These operators applied to over 1,100 companies across sectors such as software, staffing, healthcare, and finance, submitting up to 60 applications daily. Utilizing AI-generated profile photos, custom ChatGPT assistants, and illicit identity documents, they secured employment at numerous organizations, posing significant insider threats. Once employed, PurpleDelta operatives recorded internal meetings, used screen recording software during work sessions, and coordinated via platforms like Telegram and Slack. Their activities are consistent with broader North Korean IT worker threats, presenting material risks to organizations hiring for remote technical roles. The sophistication and scale of PurpleDelta's operations underscore the evolving nature of cyber threats, particularly those involving state-sponsored actors leveraging advanced technologies to infiltrate organizations. This incident highlights the urgent need for companies to enhance their vetting processes for remote hires, implement robust monitoring systems, and stay vigilant against increasingly sophisticated social engineering tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
TwinLoot Malware: A New Era of Cloud-Based Cyber Threats
Computer Software/Engineering2 months ago

TwinLoot Malware: A New Era of Cloud-Based Cyber Threats

In August 2026, researchers uncovered 'TwinLoot,' a sophisticated Python-based malware framework that exploits Microsoft Azure and 365 services for its command-and-control operations. By leveraging SharePoint Online, Microsoft Graph API, and Teams' TURN relay infrastructure, TwinLoot disguises its malicious activities as legitimate cloud traffic. The malware's capabilities include credential harvesting through fake Windows lock screens, establishing reverse SOCKS5 proxies for network infiltration, executing arbitrary commands, and achieving persistence via a novel method termed 'Corrupting the Hive Mind,' which creates offline-forged mandatory profile hives without administrative privileges. This incident underscores the evolving threat landscape where attackers increasingly abuse trusted cloud services to evade detection. Organizations must enhance their monitoring of cloud-based activities and adopt behavioral analytics to identify anomalies indicative of such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ransom Busters: A New Deceptive Tactic in Ransomware Attacks
Financial Services2 months ago

Ransom Busters: A New Deceptive Tactic in Ransomware Attacks

In August 2026, a malicious entity known as "Ransom Busters" emerged, posing as an incident-recovery service to exploit victims of ransomware attacks. This group contacted victims, claiming to have infiltrated ransomware-as-a-service (RaaS) operations and offering to return stolen data and destroy backups for fees ranging from $20,000 to $60,000. Investigations revealed that Ransom Busters was likely a ransomware affiliate attempting to divert ransom payments from the original RaaS operators. This incident underscores the evolving tactics of ransomware affiliates, highlighting the need for organizations to exercise caution when approached by unsolicited recovery services. The deceptive practices employed by Ransom Busters emphasize the importance of verifying the legitimacy of any third-party offering assistance post-attack.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports