Healthcare threat intelligence report — 30 May – 5 June 2026

• Reference: TI-2026-0605-005 (public edition)
• Sector: Healthcare
• Reporting period: 30 May – 5 June 2026
• Issued: 5 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

The healthcare collection picture this week has been shaped by the Health-ISAC 2026 threat-landscape report's continuing emphasis on Qilin, INC Ransom and SAFEPAY as the most active groups targeting health entities, with AI-enabled attack tactics flagged as the number-one concern for the year. The continuing fallout from the 2025 NHS-supplier incidents (DXS International, Synnovis legacy issues, Barts Health legal action) continues to define the UK sector loss narrative. The Android Framework integer-overflow vulnerability CVE-2025-48595 (KEV 02 June) is acutely relevant given the prevalence of Android-based clinical and patient-facing handsets in NHS and private-healthcare estates.

Perimeter scrubbing was dominated by sustained brute-force pressure from the standing IP Insights 'critical' tail - none successful. The continuing surge in Health-ISAC-reported VPN-exploit activity and ransomware against healthcare systems means that the sector continues to carry the highest composite risk rating in this report cycle.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that Qilin, INC Ransom and SAFEPAY will continue to dominate ransomware activity against UK and EU healthcare entities over the next reporting cycle, with consequences for patient care, regulatory exposure and supplier integrity. (HIGH confidence)
2. It is likely that the Android Framework integer-overflow CVE-2025-48595 will be exploited against clinical or patient-facing Android handsets in the next reporting cycle, with consequences ranging from credential-theft to data exfiltration from MDM-managed devices. (MEDIUM-HIGH confidence)
3. It is highly likely that VPN-credential exploitation against healthcare-supplier estates will continue at the elevated cadence reported in Health-ISAC's Heartbeat advisories, with Akira and Qilin as the dominant beneficiaries. (HIGH confidence)
4. It is highly likely that AI-enabled social engineering - including deepfake voice and synthetic-identity bypass of caller-verification - will continue to grow as a fraud and credential-theft vector against NHS-supplier and private-healthcare contact-centres. (HIGH confidence)
5. It is a realistic possibility that the BeyondTrust ransomware-risk pattern flagged by Health-ISAC will produce at least one publicly-disclosed UK healthcare event in the next two cycles. (MEDIUM confidence)

2. Sector threat landscape

Healthcare continues to carry the highest composite-risk rating among the verticals in this report cycle on account of the combination of operational consequence (patient-care disruption), regulatory exposure (NHS DSP Toolkit, ICO, CQC), supplier-chain dependency and a target population that historically has lagged in detection and response maturity. The Health-ISAC 2026 threat-landscape report tracks 455 ransomware incidents globally targeting health organisations in 2025, with Qilin, INC Ransom and SAFEPAY as the dominant groups.

Edge-appliance and VPN-credential exposure is the principal initial-access route. Health-ISAC Heartbeat advisories have flagged continuing exploitation of Fortinet, Citrix and Cisco VPN/edge appliances against healthcare-supplier estates.

Mobile-device exposure is acutely relevant this cycle. The Android Framework integer-overflow CVE-2025-48595, added to KEV on 02 June, is under limited targeted exploitation per Google's confirmation. NHS-supplier and private-healthcare estates running MDM-managed Android handsets - including clinical-staff devices and patient-facing kiosks - should treat this as a high-priority remediation. The CVE-2026-33825 Microsoft Defender BlueHammer LPE chain has direct relevance to Windows endpoint estates supporting clinical workstations.

AI-enabled threat tactics are the number-one concern flagged by Health-ISAC's executive survey for 2026. Deepfake voice impersonation of clinical staff for caller-verification bypass at NHS-supplier contact-centres, synthetic-identity onboarding of fraudulent contractors and LLM-authored spear-phishing of finance and procurement functions are all observed patterns; the marginal cost of these attacks has fallen sharply through the past 12 months.

Perimeter scrubbing handled sustained brute-force pressure from the standing IP Insights 'critical' tail - none successful.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Healthcare relevance.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential IAB initial access; ESXi-aware encryptor; double-extortion; healthcare-supplier targeting
• Tooling / Malware Families: Qilin.B encryptor; SystemBC, AnyDesk, rclone
• Recent Activity: 101 victims posted in May 2026; Health-ISAC continues to flag Qilin as one of three most-active groups against the health sector.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH

INC Ransom

• Aliases: GOLD IONIC; Vanir Group successor lineage
• Suspected Origin: Unattributed (likely Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Cross-sector with sustained Healthcare relevance.
• Geographic Focus: Global; sustained UK and US healthcare pattern
• Signature TTPs: Edge-appliance exploitation; rapid affiliate cycle; double-extortion
• Tooling / Malware Families: INC encryptor; SystemBC; Cobalt Strike
• Recent Activity: Health-ISAC 2026 report cites INC Ransom as one of three most-active groups against the health sector.
• Assessed Threat to Vertical: HIGH for healthcare; Admiralty A2.
• Analytic Confidence: HIGH

SAFEPAY

• Aliases: -
• Suspected Origin: Unattributed
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Cross-sector with sustained Healthcare relevance.
• Geographic Focus: Global; sustained healthcare interest
• Signature TTPs: Phishing -> IAB hand-off -> ESXi mass-encryption
• Tooling / Malware Families: SAFEPAY encryptor; SystemBC
• Recent Activity: Health-ISAC 2026 report flags SAFEPAY among three most-active groups against the health sector.
• Assessed Threat to Vertical: HIGH for healthcare; Admiralty A2.
• Analytic Confidence: MEDIUM-HIGH

Akira

• Aliases: -
• Suspected Origin: Russia / CIS criminal milieu
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Cross-sector with sustained Healthcare relevance.
• Geographic Focus: Cross-sector, global; sustained healthcare pattern
• Signature TTPs: VPN initial access (SonicWall, Cisco AnyConnect); rapid lateral via RDP; Rust encryptor
• Tooling / Malware Families: Akira / Megazord encryptors; Cobalt Strike; rclone
• Recent Activity: 52 victims posted in May 2026; H-ISAC and CISA / AHA joint warning on evolving Akira threat.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Defend

Preventive priorities: patch Fortinet FortiClient EMS to 7.4.2 or later as the single highest-value action of the cycle; force the June 2026 Android security patch via MDM to all clinical and patient-facing handsets; force MoCAMP 4.18.26040.1011; apply the 14 May Exchange OOB update; verify SD-WAN ED 26-03 closure. Rotate any VPN admin credentials whose issue-date predates 01 February 2026. Strengthen caller-verification scripts at NHS-supplier and private-healthcare contact-centres to incorporate deepfake-resistant secondary-channel verification. Reference NHS DSP Toolkit and ISO/IEC 27001 Annex A.5.7, A.8.8 and A.5.23, and the H-ISAC standing supplier-resilience advisory.

Disrupt

Disruption priorities: (i) sustained Health-ISAC participation and Heartbeat indicator exchange, with this week's IP Insights 'critical' tail submitted as the highest-value contribution; (ii) coordinated takedown of attacker-controlled rclone / MEGA / AzCopy egress destinations through registrar-abuse and Cloudflare / Microsoft / Google trust-and-safety channels; (iii) tabletop exercises around the NHS-supplier supply-chain scenario and the deepfake caller-verification bypass; (iv) deception deployment around fake VPN endpoints and fake clinical-system admin endpoints.

10. Forward outlook

Looking forward to the next reporting period (06 - 12 June 2026), it is highly likely that at least one UK or EU healthcare-supplier entity will be named on a Qilin, INC Ransom, SAFEPAY or Akira leak-site posting, with HIGH confidence based on the May 2026 cadence and Health-ISAC tracking. It is likely that at least one publicly-disclosed Android-handset compromise traceable to CVE-2025-48595 will surface within the cycle. It is a realistic possibility that an AI-enabled social-engineering incident against a UK NHS-supplier contact-centre will be reported.

Trigger conditions that would prompt revision include: (a) a UK NHS-supplier publicly attributing a breach to Akira VPN-credential exploitation or FortiClient EMS; (b) a Health-ISAC TLP:CLEAR Heartbeat advisory pointing to a sector-wide campaign; (c) NCSC-UK or NHS England notice of supplier-chain compromise.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.