Healthcare threat landscape
Hospitals, clinics and pharma — where ransomware disruption has real-world patient impact and records fetch premium prices.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 19
- Actively-attacked vulnerabilities (CISA KEV)
- 1
- Ransomware victims, last 90 days
- 309
- Ransomware victims, since 2026-06
- 403
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 19.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| FIN7 | FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, fin… | 366 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| EXOTIC LILY | EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including [Conti](https://attack… | 323 |
| Turla | Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range… | 246 |
| Leviathan | Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citat… | 236 |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 210 |
| FIN4 | FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since a… | 196 |
| Wizard Spider | Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. [Wizard… | 191 |
| Play | Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructur… | 182 |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 168 |
| Fox Kitten | Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North Am… | 164 |
| menuPass | menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Mi… | 153 |
| Deep Panda | Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healt… | 130 |
| Orangeworm | Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Sym… | 113 |
| Tropic Trooper | Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focus… | 89 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 45.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Wocao | Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| C0010 | C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts op… | — | — |
| SharePoint ToolShell Exploitation | The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code exe… | — | — |
| DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel | DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer af… | — | 2026-10-15 |
| Caught in 4K: The Gentlemen Files | A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent lea… | — | 2026-10-05 |
| Counterfeit installers to system compromise: Tracking a deceptive software download campaign | A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users… | — | 2026-10-02 |
| NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activ… | — | 2026-09-29 |
| ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and governme… | — | 2026-09-28 |
| Galago Ransomware Emerges With Shared Infrastructure Ties to Panzer | Galago is a newly identified ransomware operation that emerged in September 2026, claiming operational partnership with the Panzer ransomware group. The connection is suggested through shared infrastructure, specifically matching prefixes i… | — | 2026-09-24 |
| Fraudulent Employment Operations | Multiple clusters of North Korean IT workers, designated as PurpleDelta, have been identified applying to over 1,100 companies between late 2024 and early 2025, primarily targeting software, technology, staffing, consulting, and healthcare… | — | 2026-09-17 |
| From Fake DocuSign to ScreenConnect: Attack Blocked | Threat actors exploited trusted brands and cloud services in a sophisticated web campaign combining fraudulent DocuSign workflows, Florida healthcare screening lures, and deceptive cloud infrastructure to deploy ConnectWise ScreenConnect Ac… | — | 2026-09-11 |
| Fake Software Installers Disable Windows Update and Weaken Microsoft Defender | An active malware campaign utilizes fraudulent software-download websites impersonating trusted vendors to distribute malicious installers. The operation primarily targets China-based operations of multinational organizations and Chinese-sp… | — | 2026-09-03 |
| Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization Research | Analysis of server infrastructure revealed a complete TukTuk C2 framework (version 2.0) with cross-platform capabilities, including Windows and Linux agents, backend infrastructure, and management panel. The server contained eb.sys matching… | — | 2026-09-03 |
| Analysis of a Phishing Email Attack Case | The Larva-24009 threat actor, also known as HeptaX, has been conducting phishing email campaigns since 2023, targeting Korean and global users to install malware. Active through 2026, the actor uses LNK files disguised as documents with top… | — | 2026-09-02 |
| JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake | In mid-April 2026, an exposed directory on an Alibaba Cloud server revealed a comprehensive China-nexus operation targeting government, healthcare, and education sectors across Southeast Asia and Latin America. The investigation uncovered s… | — | 2026-08-22 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 254.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 1 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2023-43208 | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability | NextGen Healthcare · Mirth Connect | 2024-05-20 |
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2025-0603 | 9.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvis… | |
| CVE-2025-60231 | 9.8 | Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.… | |
| CVE-2025-69942 | 9.8 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.… | |
| CVE-2023-43208 | 9.8 | NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.… | KEV |
| CVE-2025-65340 | 9.8 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.… | |
| CVE-2025-69943 | 9.8 | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.… | |
| CVE-2026-52723 | 9.1 | ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in a… | |
| CVE-2026-105279 | 9.1 | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also u… | |
| CVE-2025-15240 | 8.8 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary co… | |
| CVE-2026-13613 | 8.8 | The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL inje… | |
| CVE-2026-54671 | 8.8 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty… | |
| CVE-2026-78685 | 8.8 | Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.… | |
| CVE-2026-90983 | 8.2 | Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.… | |
| CVE-2026-44506 | 8.2 | Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined v… | |
| CVE-2025-35030 | 8.1 | Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on be… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Healthcare), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Dental Team FL | qilin | 2026-10-19 |
| Kingwood Endoscopy | N0n | 2026-10-19 |
| passavant-ee.com | settra | 2026-10-18 |
| Personify Health | Helix | 2026-10-17 |
| Gio Dental Med Spa | thegentlemen | 2026-10-17 |
| First Dental Health | thegentlemen | 2026-10-17 |
| EnVision Eye Care | N0n | 2026-10-16 |
| SBI Audiovisual Medinbox | thegentlemen | 2026-10-16 |
| Skin Center | thegentlemen | 2026-10-16 |
| Hospital Sírio-Libanês | THE SEVEN DEADLY SINS | 2026-10-16 |
| Taiwan Otsuka Pharmaceutical | thegentlemen | 2026-10-16 |
| CLIMEDI | thegentlemen | 2026-10-16 |
| iHeartJane | THE SEVEN DEADLY SINS | 2026-10-16 |
| Newport Beach Dentistry | thegentlemen | 2026-10-16 |
| Shared Medical Technology | thegentlemen | 2026-10-16 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches healthcare — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.