Healthcare threat intelligence report — 6–12 June 2026

• Reference: TI-2026-0612-005 (public edition)
• Sector: Healthcare
• Reporting period: 6–12 June 2026
• Issued: 12 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Healthcare sector during the period 06 Jun 2026 - 12 Jun 2026. It is intended to support security leadership and operational defenders within the vertical and is issued under TLP:CLEAR.

The healthcare-sector collection picture this week sits against the Health-ISAC 2026 Global Health Sector Threat Landscape Report's documented 55% surge in incidents through 2025 and its identification of Qilin, INC Ransom and SAFEPAY as the most active ransomware groups targeting health entities. The week's new CISA KEV additions land directly on healthcare-relevant infrastructure: the no-patch Cisco SD-WAN Manager (CVE-2026-20245) and Arista EOS (CVE-2026-7473) defects affect hospital data-centre fabrics; Chromium V8 (CVE-2026-11645) affects clinical-portal browser estates; the Linux cgroup container-escape revival (CVE-2022-0492) affects healthcare cloud workloads.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that Qilin will retain its position as the dominant ransomware threat to healthcare entities globally over the next reporting cycle, consistent with the Health-ISAC 2026 annual report's identification of Qilin as the most active group targeting the sector. (HIGH confidence)
2. It is highly likely that the no-patch Cisco SD-WAN Manager (CVE-2026-20245) and Arista EOS (CVE-2026-7473) defects will be exploited against at least one healthcare data-centre estate globally within the next two reporting cycles. (MEDIUM-HIGH confidence)
3. It is likely that NHS supply-chain providers and pathology / diagnostic-imaging service providers will continue to be targeted, with the 2024 Synnovis precedent continuing to inform the threat model. (HIGH confidence)
4. It is highly likely that AI-augmented spear-phishing of clinical staff and finance teams will continue to grow as a fraud-adjacent threat, with consequences ranging from EHR-credential theft to wire-fraud and synthetic-identity benefits fraud. (HIGH confidence)
5. It is a realistic possibility that container-escape exploitation of CVE-2022-0492 (revived for cloud workloads) will be observed against healthcare cloud-native EHR / PACS deployments over the period. (MEDIUM confidence)

2. Sector threat landscape

The healthcare vertical faces what Health-ISAC's 2026 Global Health Sector Threat Landscape Report characterises as a 'perfect storm of escalating threats, inadequate defenses and potentially life-threatening operational disruptions'. The report tracks 455 ransomware incidents globally through 2025 - a 55% surge year-on-year - and identifies Qilin, INC Ransom and SAFEPAY as the most active ransomware groups against the sector. The June 2024 Synnovis attack disrupting seven London hospital systems remains the canonical UK precedent and continues to inform NHS supply-chain risk modelling.

Edge-appliance and infrastructure exposure dominates the week's new CVE picture for the sector. The Cisco Catalyst SD-WAN Manager defect CVE-2026-20245 (no patch) and the Arista EOS tunnel-decap defect CVE-2026-7473 (no patch planned) are both relevant to hospital data-centre fabrics. The Linux kernel cgroup container-escape revival CVE-2022-0492 (KEV listing 02 June) is relevant to cloud-native EHR, imaging and analytics workloads increasingly common in NHS Trust and private-provider estates. The Citrix NetScaler advisories (CVE-2026-3055 / -4368) sit against the VPN concentrators used to reach NHS and private-provider remote-clinical estates.

Healthcare supply-chain providers continue to represent the highest-leverage attack vector for the sector. Pathology / diagnostic-imaging providers (Synnovis pattern), electronic-records vendors and the prescribing / pharmacy chain are all known target classes. Health-ISAC's quarterly Heartbeat reports continue to flag VPN-exploit pressure and ransomware attempts against US hospital systems; UK-specific Patient Safety Alerts and the NHS Digital Cyber Alerts service continue to provide aligned bulletins.

AI-augmented social engineering against clinical and administrative staff is a growing fraud-adjacent threat. Convincing voice and video deepfakes are now being used in synthetic-identity benefits fraud, and the long-running 'I am a doctor at [hospital]' scam pattern has matured into multi-channel sequences using LLM-generated personas. The MHRA, NHS Digital and ICO have issued aligned guidance during 2026.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda, Qilin.B)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russia (Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion / data theft
• Sector Targeting: Healthcare primary; identified by Health-ISAC 2026 as the most active healthcare-targeting ransomware group.
• Geographic Focus: Global; UK, EU, US, ANZ
• Signature TTPs: VPN-credential initial access via IABs; rapid DCSync; ESXi-aware encryptor; double-extortion with leak-site countdown
• Tooling / Malware Families: Qilin.B encryptor (Rust/Go), SystemBC, AnyDesk, Cobalt Strike, mimikatz, rclone
• Recent Activity: 97-101 victims posted in May 2026 - fifth consecutive month at top of leak-site postings (BreachSense / Check Point).
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH - multiply sourced (Check Point Research, BreachSense, Ransomware.live)

INC Ransom

• Aliases: INC, Inc Ransom
• Suspected Origin: Unattributed (likely Russian-speaking)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Healthcare primary - identified by Health-ISAC 2026 as one of the most active healthcare-targeting groups.
• Geographic Focus: Global; UK and US healthcare entities targeted
• Signature TTPs: Edge-appliance exploitation; lateral movement via PsExec; data-exfiltration prior to encryption
• Tooling / Malware Families: INC encryptor (C++); SystemBC; commodity LOLBin chains
• Recent Activity: Persistent leak-site posting through 2026; continues to feature in healthcare-targeting reports.
• Assessed Threat to Vertical: HIGH - Admiralty B2.
• Analytic Confidence: HIGH

SAFEPAY

• Aliases: -
• Suspected Origin: Unattributed
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion
• Sector Targeting: Healthcare primary - identified by Health-ISAC 2026 as one of the most active healthcare-targeting groups.
• Geographic Focus: Global
• Signature TTPs: VPN-credential abuse; ESXi-aware encryption
• Tooling / Malware Families: SAFEPAY encryptor; commodity tooling
• Recent Activity: Ongoing healthcare-sector activity per Health-ISAC 2026 annual report.
• Assessed Threat to Vertical: HIGH - Admiralty C2.
• Analytic Confidence: MEDIUM-HIGH

Scattered Spider / DragonForce affiliate cluster

• Aliases: UNC3944, Octo Tempest, Muddled Libra, 0ktapus, Scatter Swine
• Suspected Origin: UK / US / English-speaking community
• Suspected Sponsor: Criminal (IAB into DragonForce / LockBit / Qilin)
• Primary Motivation: Financial - extortion via partner ransomware
• Sector Targeting: Cross-sector with documented Healthcare-sector relevance through BPO and helpdesk-supplier targeting.
• Geographic Focus: UK, US, increasing EU and outsourced helpdesks abroad
• Signature TTPs: Voice-phishing of IT helpdesks, SIM-swap, MFA fatigue, OAuth consent-phish, RMM abuse (AnyDesk / ScreenConnect)
• Tooling / Malware Families: DragonForce / LockBit / Qilin partner encryptors; ESXi mass-encryption
• Recent Activity: DragonForce 32 victims in May 2026 (down from 41 in April per BreachSense); BPO / outsourced-helpdesk pattern continues.
• Assessed Threat to Vertical: HIGH - Admiralty A2.
• Analytic Confidence: HIGH - NCSC-UK, Sophos X-Ops, CrowdStrike, Mandiant multi-sourced

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should prioritise (a) Cisco SD-WAN Manager netadmin role activity and configuration-push events; (b) Arista EOS tunnel-protocol decap conflation; (c) NetScaler tampering and session-token reuse outside expected geographies; (d) Fortinet FortiClient EMS admin-endpoint anomaly; (e) container-escape primitives (cgroup release_agent abuse, host-namespace traversal) against EHR / PACS clusters; (f) OAuth consent-grant anomalies against M365 healthcare tenants; (g) clinical-portal credential-stuffing patterns.

Defend

Preventive priorities follow Section 6: enforce mitigation-only postures for CVE-2026-20245 and CVE-2026-7473; patch FortiClient EMS to 7.4.2; apply Citrix NetScaler firmware; force Chromium update for CVE-2026-11645; enforce seccomp / AppArmor / SELinux on container hosts and verify kernel >= 5.16.4 to close CVE-2022-0492; force Defender MoCAMP roll-up. Verify immutable backup posture for EHR and PACS hypervisor estates. Validate Health-ISAC indicator-ingestion and the NHS Digital Cyber Alerts subscription.

Disrupt

Disruption activity within client lawful authority should focus on: (i) Health-ISAC indicator sharing with this week's IP Insights critical tail as the highest-value contribution; (ii) takedown of attacker-controlled rclone / MEGA / AzCopy egress destinations; (iii) coordinated takedown of NHS-themed credential-phish landings through registrar-abuse channels; (iv) sector-coordinated tabletop exercise with pathology / diagnostic-imaging supply-chain partners.

10. Forward outlook

Looking forward to the next reporting period (13-19 Jun 2026), it is highly likely that Qilin will retain leak-site dominance against healthcare; it is likely that at least one UK or EU healthcare entity will publicly disclose an incident traceable to one of the flagged CVEs. Pathology / diagnostic-imaging supply-chain risk is highly likely to remain at current levels.

Trigger conditions that would prompt revision of this outlook include: (a) a UK NHS Trust publicly attributing a breach to NetScaler or FortiClient EMS exploitation; (b) appearance of a Qilin or INC Ransom leak-site post naming a UK healthcare entity; (c) Health-ISAC TLP:CLEAR notification of a sector-wide EHR-vendor compromise; (d) NHS Digital Cyber Alert escalation. The principal intelligence gap is direct visibility into Health-ISAC TLP:CLEAR traffic for the 06-12 Jun period.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.