Healthcare threat intelligence report — 27 April – 3 May 2026

• Reference: TI-2026-0504-005 (public edition)
• Sector: Healthcare
• Reporting period: 27 April – 3 May 2026
• Issued: 4 May 2026 · Lead analyst: P. Bassill (SOC Lead) · Reviewed by: SOC Reviewing Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The healthcare threat picture for the reporting period continues to escalate. Health-ISAC reporting flags a 55% surge in cyber incidents in 2025 with continued escalation expected in 2026. Comparitech recorded 201 healthcare ransomware attacks in Q1 2026 — 120 against direct providers and 81 against sector-adjacent businesses. Qilin, INC Ransom and SAFEPAY are the dominant ransomware operators against the vertical, with Qilin behind the most confirmed provider attacks during the reporting period. The University of Mississippi Medical Center (Feb 2026, US) and Nippon Medical School Musashi Kosugi Hospital (Feb 2026, Japan, 131,700 records) remain the headline-case studies.

Key Judgements

1. It is highly likely that ransomware will remain the principal material-risk scenario for the healthcare vertical over the next reporting cycle, with Qilin, INC Ransom and SAFEPAY the most operationally-relevant operators. (HIGH confidence)

2. It is highly likely that VPN- and edge-appliance-exploitation will continue to be the dominant initial-access vector against healthcare providers, with Citrix NetScaler CVE-2026-3055 / 4368 the immediate concern. (HIGH confidence)

3. It is likely that AI-enabled ransomware tradecraft — particularly automated phishing and reconnaissance — will materially increase the operational tempo of healthcare-targeted campaigns through the rest of 2026. (MEDIUM-HIGH confidence)

4. There is a realistic possibility that a UK NHS Trust or material UK healthcare provider will suffer a multi-day operational outage from ransomware within the next six reporting cycles. (MEDIUM confidence)

2. Sector threat landscape

The healthcare vertical absorbed a 55 per cent surge in cyber incidents through 2025 according to Health-ISAC, with continued escalation expected through 2026. Comparitech recorded 201 healthcare ransomware attacks in Q1 2026 alone — 120 against direct providers (hospitals, clinics, group practices) and 81 against sector-adjacent businesses (pharmaceutical, medical-device, payer). The trajectory has not flattened during the April-May 2026 reporting period.

The dominant ransomware operators against the vertical during the reporting period are Qilin, INC Ransom and SAFEPAY. Qilin retains the leading position with 103 leak-site postings in April 2026 and was behind the most confirmed direct-provider attacks during the same period. INC Ransom continues to favour the public-sector-and-healthcare lane, and SAFEPAY has emerged as a high-tempo follow-on actor. LockBit and TheGentlemen each posted three confirmed healthcare-provider incidents during the reporting period.

The headline-case studies remain the University of Mississippi Medical Center incident of February 2026 (US, multi-clinic operational shutdown) and Nippon Medical School Musashi Kosugi Hospital incident of February 2026 (Japan, NetRunner attribution, 131,700 individuals impacted). The H-ISAC Heartbeat reporting flags a sustained surge in VPN-exploit-driven intrusions across healthcare systems, consistent with the wider organised-criminal pattern.

AI-enabled tradecraft is a structural concern for 2026 healthcare. The Health-ISAC 2026 annual reporting describes the sector as facing an existential cybersecurity crisis with ransomware, supply-chain attacks, and AI-powered threats surging in parallel; the same reporting flags AI-augmented phishing and reconnaissance as the principal threat-tempo multiplier through the rest of the year.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period.

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period.

5. Notable incidents and campaigns

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue.

7. Indicators of compromise

Indicators are defanged in line with industry convention. Confidence ratings reflect the analyst's assessment of the strength of the association between the indicator and the named actor or campaign. IP Insights reputation feed currently lists 812,641 distinct IPv4 addresses across active blocklists (snapshot 04 May 2026 08:15 UTC). AS200651 (FlokiNET) currently lists 110 of 131 known IPs as blacklisted (risk score 100/critical); the AS continues to host bulletproof-style infrastructure observed in the reporting period across phishing, RAT C2, and brute-force activity.

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection priorities are: hunting for rclone / Mega.io / putty-pscp egress against EHR / shared-clinical file-stores; PowerShell -ExecutionPolicy Bypass parented by non-baseline processes; LSASS access by non-security-tooling processes; Citrix NetScaler / FortiOS / Exchange exploitation indicators as soon as vendor signatures and Sigma rules are released; and AI-augmented-phishing-flag features in the email-security pipeline. Where customers operate shared payer / EHR / pharmacy platforms, hunting for the Cl0p / MOVEit-pattern web-shell-drop-and-mass-exfil chain is warranted.

Defend

Patching priorities are dominated by Citrix NetScaler ADC / Gateway, FortiOS, Microsoft Exchange and the Linux kernel CVE-2026-31431. The CISA KEV April additions should be patched on the published federal-deadline schedule. Identity-controls hardening to mitigate clinical-staff phishing remains the highest-impact defensive investment; conditional-access rules requiring known-device tokens for high-privilege accounts should be the operating standard. ISO/IEC 27001 Annex A A.5.34 (privacy and protection of PII) and the NHS Data Security and Protection Toolkit are direct levers for UK customers; HIPAA Security Rule for any US-aligned operations. Backup-and-restore drilling against the multi-day operational-outage scenario should be rehearsed at the corporate-IT-and-clinical-systems boundary.

Disrupt

Disruption priorities are sustained sharing of the IP Insights blocklist into customer perimeter-block lists; coordination with Health-ISAC where customers are members; tabletop exercise against the multi-day clinical-systems outage scenario; rehearsal of the patient-data-extortion communications playbook; and coordination with NHS England and NCSC where UK NHS Trust customers are in scope.

10. Forward outlook

It is highly likely that ransomware will remain the principal material-risk scenario for the healthcare vertical over the next reporting cycle, with Qilin, INC Ransom and SAFEPAY the most operationally-relevant operators. (HIGH confidence; 30-day horizon)

It is likely that Citrix NetScaler exploitation will affect at least one healthcare-vertical edge appliance within the next two reporting cycles. (HIGH confidence; 60-day horizon)

It is likely that AI-augmented phishing volumes against clinical staff will rise materially through the next two reporting cycles. (MEDIUM-HIGH confidence; 60-day horizon)

There is a realistic possibility that a UK NHS Trust or material UK healthcare provider will suffer a multi-day operational outage from ransomware within the next six reporting cycles. (MEDIUM confidence; 180-day horizon)

Trigger conditions that would prompt revision of this forecast: a confirmed major ransomware deployment against a UK NHS Trust; in-the-wild exploitation of a previously-quiet healthcare SaaS platform along the Cl0p pattern; a confirmed AI-agent-driven intrusion in the vertical.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst's assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.