Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 72 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 853–864 / 3490 reports
Critical Vulnerability in Thermo Fisher Genetic Analyzers: CVE-2026-17583
Card image — Critical Vulnerability in Thermo Fisher Genetic Analyzers: CVE-2026-17583
Health Care / Life Sciences3 months ago

Critical Vulnerability in Thermo Fisher Genetic Analyzers: CVE-2026-17583

In August 2026, Thermo Fisher Scientific disclosed a critical vulnerability (CVE-2026-17583) in their Applied Biosystems Genetic Analyzers. The flaw allowed unauthorized modification of .fsa and .hid output files, potentially leading to inaccurate DNA test results. Affected products included various versions of the 3500/3500xL, 3730/3730xL, SeqStudio, SeqStudio Flex, GeneMapper ID-X, 3130 Series, ABI PRISM 3100/3100-Avant, and ABI PRISM 310 Data Collection Software. Thermo Fisher released security updates to address the issue, implementing digital signatures to verify data file integrity. This incident underscores the critical importance of data integrity in medical devices, especially those used in genetic analysis. The vulnerability highlights the need for robust security measures to prevent unauthorized data manipulation, which can have significant implications for patient care and research outcomes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Microsoft Defender's Rapid Response Halts QNET Cyberattack in 2026
Card image — Microsoft Defender's Rapid Response Halts QNET Cyberattack in 2026
Information Technology/IT3 months ago

Microsoft Defender's Rapid Response Halts QNET Cyberattack in 2026

In August 2026, QNET, a global direct-selling company, experienced a multi-stage cyberattack where an adversary utilized a legitimate Windows tool to execute a malicious payload. Microsoft Defender's new device isolation feature autonomously intervened, isolating the compromised endpoint within 128 seconds of detection, effectively halting the attack before the second-stage payload could establish persistence or propagate laterally. This swift response prevented potential data exfiltration and operational disruption. The incident underscores the growing prevalence of sophisticated attacks leveraging legitimate tools to evade detection. It highlights the critical importance of advanced, automated defense mechanisms like device isolation in rapidly containing threats and minimizing organizational impact.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
INC Ransomware's Exploitation of SonicWall Zero-Day Vulnerabilities in 2026
Card image — INC Ransomware's Exploitation of SonicWall Zero-Day Vulnerabilities in 2026
Government Administration3 months ago

INC Ransomware's Exploitation of SonicWall Zero-Day Vulnerabilities in 2026

In June 2026, the INC ransomware group exploited two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SonicWall's Secure Mobile Access (SMA) 1000 Series appliances. These vulnerabilities allowed unauthenticated attackers to gain root-level access, leading to the deployment of ransomware and potential data exfiltration. The attacks began on June 22, 2026, prior to SonicWall's disclosure and patch release on July 14, 2026. Organizations utilizing these appliances were urged to apply patches immediately and investigate for signs of compromise. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/07/21/sonicwall-sma-zero-days-exploited-cve-2026-15409-cve-2026-15410/?utm_source=openai)) This incident underscores the increasing trend of ransomware groups targeting critical infrastructure through zero-day vulnerabilities. The rapid exploitation of these flaws highlights the need for organizations to maintain vigilant patch management practices and implement robust monitoring to detect unauthorized access promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Massive Supply Chain Attack: TeamPCP's 'Mini Shai-Hulud' Worm Compromises Over 440 npm Packages
Card image — Massive Supply Chain Attack: TeamPCP's 'Mini Shai-Hulud' Worm Compromises Over 440 npm Packages
Computer Software/Engineering3 months ago

Massive Supply Chain Attack: TeamPCP's 'Mini Shai-Hulud' Worm Compromises Over 440 npm Packages

In May 2026, the cybercriminal group TeamPCP executed a rapid supply chain attack, compromising over 440 npm packages within four hours. Utilizing the 'Mini Shai-Hulud' worm, they injected malicious code into widely-used packages such as keyv, flat-cache, and file-entry-cache, affecting software with a combined total of over 2 billion monthly installs. The malware harvested sensitive data, including npm, GitHub, AWS credentials, AI configuration files, and cryptocurrency wallets, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation and extensive reach of the 'Mini Shai-Hulud' worm highlight the need for enhanced security measures, including rigorous package vetting, continuous monitoring, and the adoption of zero-trust principles to safeguard against such pervasive threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Pass-ta-key Attacks: A New Threat to Passwordless Authentication
Card image — Pass-ta-key Attacks: A New Threat to Passwordless Authentication
Financial Services3 months ago

Pass-ta-key Attacks: A New Threat to Passwordless Authentication

In August 2026, security researchers from Palo Alto Networks' Unit 42 identified three novel attacks, collectively termed "Pass-ta-key," targeting Google Password Manager's passkey synchronization on Windows devices equipped with Trusted Platform Modules (TPMs). These attacks enable malware on already-compromised systems to impersonate trusted devices, register malicious user-verification keys, and extract master keys used to encrypt all synced passkeys. Notably, the "Golden Pass-ta-key" technique allows attackers to access the security domain secret, potentially compromising all passkeys stored in the victim's Google Password Manager. This incident underscores the evolving threats to passwordless authentication systems and highlights the necessity for robust validation mechanisms and secure handling of cryptographic materials. Organizations must reassess their reliance on passkey synchronization and implement additional safeguards to mitigate such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Phishing Service Exploits RingCentral to Compromise Microsoft 365 Accounts
Information Technology/IT3 months ago

Phishing Service Exploits RingCentral to Compromise Microsoft 365 Accounts

In August 2026, the 'Greatness' phishing-as-a-service platform expanded its operations to include adversary-in-the-middle attacks and device-code phishing, specifically targeting Microsoft 365 accounts. Cybercriminals leveraged this platform to impersonate RingCentral, a widely-used communications service, by sending fraudulent emails that appeared to originate from service@ringcentral.com. These emails, often containing fake voicemail and performance-review notifications, successfully bypassed email security filters due to RingCentral's whitelisted status. Upon clicking embedded links, victims were redirected to phishing sites designed to capture authentication tokens, enabling attackers to access and exfiltrate data from Outlook, Teams, SharePoint, and OneDrive, with unauthorized access persisting for over two weeks in some instances. This incident underscores a significant evolution in phishing tactics, highlighting the increasing sophistication of phishing-as-a-service platforms and their ability to exploit trusted services to bypass security measures. The use of adversary-in-the-middle techniques to capture multi-factor authentication tokens represents a notable advancement in cybercriminal methodologies, emphasizing the need for organizations to continually adapt their security protocols to counteract these evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cybercriminals Exploit Cloud Platforms for Phishing in 2026
Financial Services3 months ago

Cybercriminals Exploit Cloud Platforms for Phishing in 2026

In 2026, threat actors increasingly exploited legitimate cloud services to host phishing sites, leveraging platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This approach allowed attackers to bypass traditional security measures, as phishing pages hosted on reputable domains appeared trustworthy to victims. The use of these platforms enabled the rapid deployment of multi-stage adversary-in-the-middle (AitM) attacks, effectively capturing multi-factor authentication (MFA) sessions and compromising user accounts. This trend underscores a significant shift in cybercriminal tactics, highlighting the need for enhanced detection mechanisms that go beyond domain reputation. The widespread abuse of trusted cloud services for phishing campaigns necessitates a reevaluation of current security strategies to effectively counteract these sophisticated threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Greatness PhaaS Adds Device Code Phishing to Bypass MFA
Financial Services3 months ago

Greatness PhaaS Adds Device Code Phishing to Bypass MFA

In August 2026, the 'Greatness' phishing-as-a-service (PhaaS) platform introduced device code phishing capabilities, enabling attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to Microsoft 365 accounts. This method exploits the OAuth 2.0 Device Authorization Grant, tricking users into authenticating a malicious device by entering a provided code on a legitimate Microsoft page. Once the code is entered, attackers obtain access and refresh tokens, allowing persistent access to services like Outlook, Teams, and OneDrive without needing user credentials. This development signifies a significant evolution in phishing tactics, as it leverages legitimate authentication flows to circumvent traditional security measures. The commoditization of such advanced techniques through PhaaS platforms like 'Greatness' lowers the barrier for cybercriminals, increasing the prevalence and sophistication of phishing attacks targeting organizations and individuals alike.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Unveiling the Smoke#Screen RMM Takeover: A New Threat Actor Playbook
Information Technology/IT3 months ago

Unveiling the Smoke#Screen RMM Takeover: A New Threat Actor Playbook

In August 2026, the Smoke#Screen campaign emerged, leveraging the legitimate ScreenConnect Remote Monitoring and Management (RMM) tool to gain persistent remote access to compromised networks. Attackers employed diverse social engineering lures, including fake Zoom and Adobe updates, business document requests, and system maintenance tools, to trick victims into executing malicious files. This resulted in the silent installation of ScreenConnect agents that connected to attacker-controlled relay servers, providing unauthorized access to both Windows and macOS systems. The campaign's sophistication was evident in its use of rotating payloads and varied lures, making detection challenging. This incident underscores a growing trend where threat actors exploit legitimate RMM tools to bypass security controls and maintain persistence. The evolving tactics highlight the need for organizations to enhance their defenses against such sophisticated social engineering attacks and to monitor for unauthorized installations of RMM software.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
Information Technology/IT3 months ago

CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises

In August 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity vulnerability in N-able N-central, identified as CVE-2026-18577, to its Known Exploited Vulnerabilities catalog. This flaw, resulting from incomplete patching of a previous issue, allows authentication bypass and account takeover, enabling remote attackers to gain administrative access to N-central servers. Exploitation of this vulnerability has been observed, with attackers leveraging the built-in Take Control feature to pivot into managed endpoints and establish persistence mechanisms. Indicators of compromise include the presence of a 'svchost.exe' file in user documents folders and a registered service named 'Cloudflared,' a legitimate tunneling utility often misused for covert connections. Additionally, inbound connections from specific IP addresses associated with VPN services have been noted. N-able has acknowledged that a limited number of customers were affected and has released a patch in version 2026.3 HF1 to address the issue. This incident underscores the persistent targeting of remote monitoring and management (RMM) platforms by threat actors to facilitate unauthorized access and maintain footholds within organizational networks. The exploitation of CVE-2026-18577 highlights the critical need for organizations to promptly apply security patches and monitor for signs of compromise to mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical cPanel Vulnerability CVE-2026-58048: Immediate Action Required
Internet3 months ago

Critical cPanel Vulnerability CVE-2026-58048: Immediate Action Required

In August 2026, cPanel addressed a critical vulnerability (CVE-2026-58048) that allowed authenticated users to execute SQL commands with root privileges, potentially leading to full server compromise. This flaw affected all supported versions of cPanel & WHM, as well as WP Squared. Exploitation required a valid cPanel account with access to MySQL/MariaDB features. The issue stemmed from improper handling during the database renaming process, enabling users to bypass standard privilege restrictions. cPanel released patches to mitigate this vulnerability and provided guidance for administrators unable to update immediately. This incident underscores the importance of timely patch management and the potential risks associated with privilege escalation vulnerabilities in widely used web hosting management software. Organizations should prioritize updating their systems and reviewing access controls to prevent unauthorized administrative actions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds CVE-2026-18577 to Known Exploited Vulnerabilities Catalog
Information Technology/IT3 months ago

CISA Adds CVE-2026-18577 to Known Exploited Vulnerabilities Catalog

On August 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability allows attackers to gain unauthorized access to systems by exploiting an alternate path or channel, posing significant risks to federal enterprises. CISA's inclusion of this CVE underscores the critical nature of the flaw and the necessity for immediate remediation to prevent potential breaches. The addition of CVE-2026-18577 to the KEV Catalog highlights a growing trend of authentication bypass vulnerabilities being actively exploited. Organizations are urged to prioritize patching and implementing robust access controls to mitigate the risks associated with such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports