Healthcare threat intelligence report — 13–19 June 2026

• Reference: TI-2026-0619-005 (public edition)
• Sector: Healthcare
• Reporting period: 13–19 June 2026
• Issued: 19 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Healthcare sector during the period 13 Jun 2026 - 19 Jun 2026. It is intended to support NHS trust SIROs, IG leads, hospital CIOs / CISOs, private-sector healthcare providers, pathology / diagnostics labs, GP federations and the broader UK / EU clinical-services and medical-device community.

During the reporting period the principal observations were the continuing strategic consequence of the June 2024 Synnovis / NHS London pathology compromise - South London and Maudsley NHS Foundation Trust pathology systems remained partially un-restored into early 2026, with 161,560 pathology reports pending entry as at January 2026; the H-ISAC Heartbeat reporting that ransomware and VPN-exploit pressure continues to lead the healthcare threat picture; the 55% rise in healthcare cyber incidents in 2025 vs. 2024 as documented by H-ISAC; the persistent edge-appliance exposure across NHS estates via Cisco SD-WAN Manager, Arista EOS, Citrix NetScaler ADC / Gateway and Ivanti legacy VPN. Cred-dump, C2 framework (Cobalt Strike / Sliver / Havoc / Mythic), lateral-movement (EID 4624-3/10, schtasks, sc create, WMIC remote, PsExec) and Defender-tampering / Blackbit envelopes returned zero hits across the full seven days. One Defender-disable watchlist item (DESKTOP-S8SUGSF, UAT-lab) carried forward without destructive follow-on.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that ransomware deployment - by Qilin (historical NHS targeting), DragonForce, Akira, INC Ransom and the Rhysida cluster - will continue to drive the majority of materially-disruptive incidents against UK and EU healthcare providers during the next reporting cycle. [HIGH]
2. It is likely that the Citrix NetScaler ADC / Gateway defects (CVE-2026-3055 / 4368) will produce targeted exploitation against NHS or private-healthcare remote-access estates within the next two reporting cycles, given the prevalence of NetScaler Gateway as the standard remote-access route into EPR / PAS / lab-information systems. [MEDIUM-HIGH]
3. It is a realistic possibility that a UK pathology or diagnostics shared-services compromise of Synnovis-scale will recur within Q3 or Q4 2026, given the concentrated supplier landscape, the demonstrated business model and the inadequately remediated risk surface. [MEDIUM]
4. It is likely that legacy medical-device exposure (Windows 7 / 10 embedded systems on diagnostic imaging, infusion pumps, lab analysers) will continue to provide initial-access opportunities for threat actors during the period. [HIGH]

2. Sector threat landscape

The healthcare vertical continues to absorb a high-volume, high-impact stream of cyber incidents. H-ISAC reporting documents a 55% surge in healthcare cyber incidents across 2025 versus 2024 and the trajectory into Q2 2026 has extended the trend. Ransomware is the dominant volume driver, followed by phishing, third-party / partner breaches, data breaches and zero-day exploitation per the H-ISAC 2026 Global Health Sector Threat Landscape survey. The June 2024 Synnovis / NHS London pathology compromise remains the strategic headline incident: 6,000+ procedures postponed at the time, 400 GB of patient data released, and SLaM trust pathology systems not fully restored as at January 2026 with 161,560 pathology reports pending entry into patient records. The operational implications of that single incident remain a live patient-safety issue 24 months later.

Edge-appliance exposure is materially relevant. NHS trusts and private healthcare providers run Citrix NetScaler ADC / Gateway as the standard remote-access route into EPR / PAS / lab-information systems; the NCSC-flagged CVE-2026-3055 / 4368 defects expose this route directly. The June 2026 CISA KEV additions of Cisco SD-WAN Manager (CVE-2026-20245 / 20262) and Arista EOS (CVE-2026-7473) create perimeter exposure. The Joomla Widget Factory editor defect (CVE-2026-48907) is relevant to NHS trust / GP federation public micro-sites. The LiteSpeed cPanel plugin defect (CVE-2026-54420) is relevant to private-healthcare-provider SaaS and hosting providers.

Legacy medical-device exposure remains a structural risk. Many diagnostic-imaging consoles, lab analysers and infusion-pump controllers run end-of-life Windows 7 or Windows 10 LTSB versions that cannot be patched without vendor recertification, and they sit on clinical networks with limited segmentation. The MITRE STAT April 2026 commentary describing healthcare's structural cybersecurity vulnerability remains operationally accurate.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (Agenda)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + leak-site extortion
• Sector Targeting: Healthcare, manufacturing, energy, professional services
• Geographic Focus: Global; UK NHS targeting historically demonstrated
• Signature TTPs: Phishing / exposed VPN initial access; valid-account lateral movement; AD-wide encryption; Rclone exfiltration
• Tooling / Malware Families: Qilin / Agenda ransomware (Rust / Go), Cobalt Strike, Rclone
• Recent Activity: Continued leak-site posting through the period; historical Synnovis / NHS London attribution (Jun 2024)
• Assessed Threat to Vertical: HIGH - direct UK NHS targeting history; dominant volume across healthcare-adjacent victims
• Analytic Confidence: HIGH

Rhysida

• Aliases: Rhysida
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + leak-site extortion
• Sector Targeting: Healthcare, education, public sector
• Geographic Focus: Global; UK / EU presence
• Signature TTPs: Phishing initial access; valid-account abuse; data exfiltration; encryption with bespoke crypto; CVE-2025-22457 Ivanti exploitation historically
• Tooling / Malware Families: Rhysida ransomware, Cobalt Strike, Mimikatz, AnyDesk
• Recent Activity: Continuing healthcare targeting through Q2 2026; UK trusts named in CISA / FBI advisories
• Assessed Threat to Vertical: HIGH - direct, sustained sector targeting
• Analytic Confidence: HIGH

INC Ransom

• Aliases: INC, Inc Ransom Group
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + data extortion
• Sector Targeting: Healthcare, legal, manufacturing, education
• Geographic Focus: US and UK primary; expanding EU
• Signature TTPs: Citrix Bleed / NetScaler exploitation; valid-account abuse; ESXi / Linux variants; data exfiltration
• Tooling / Malware Families: INC encryptor (Windows / Linux), AnyDesk, Rclone, Cobalt Strike
• Recent Activity: Sustained healthcare and legal sector targeting; documented 2025 NHS-adjacent incidents in CISA advisories
• Assessed Threat to Vertical: HIGH - direct sector targeting
• Analytic Confidence: HIGH

DragonForce / Scattered Spider affiliate cluster

• Aliases: UNC3944, Octo Tempest, 0ktapus, DragonForce affiliate
• Suspected Origin: Western (UK / US) English-speaking criminal cluster
• Suspected Sponsor: Criminal
• Primary Motivation: Financial - extortion via encryption and data leak
• Sector Targeting: Retail, financial services, healthcare-adjacent (insurance, BPO), telecoms
• Geographic Focus: UK and US primary; expanding EMEA
• Signature TTPs: IT-service-desk social engineering; Okta / Entra session hijack; rapid AD compromise; Rclone exfiltration; DragonForce encryptor
• Tooling / Malware Families: Okta admin abuse, Teleport, Ngrok, Mimikatz, Cobalt Strike
• Recent Activity: Continuing UK targeting; growing risk against private-healthcare insurance and BPO providers
• Assessed Threat to Vertical: MEDIUM-HIGH for private-healthcare and insurance-adjacent firms
• Analytic Confidence: HIGH

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Defend

Preventive priorities: (i) apply NCSC NetScaler mitigation (CVE-2026-3055 / 4368), rotate session secrets, force interactive-user session reset; (ii) restrict and monitor Cisco SD-WAN Manager management plane (CVE-2026-20245 / 20262); (iii) enforce Arista EOS ACLs on decap interfaces (CVE-2026-7473); (iv) patch the Joomla Widget Factory editor (CVE-2026-48907) and the LiteSpeed cPanel plugin (CVE-2026-54420); (v) force-update Chrome / Edge across the healthcare workstation estate for CVE-2026-11645; (vi) accelerate decommission of legacy Ivanti Connect Secure (CVE-2025-22457) deployments; (vii) reinforce IT-service-desk MFA-reset playbooks against Scattered Spider-style social-engineering for the healthcare insurance / BPO sub-vertical; (viii) deploy compensating controls on the legacy medical-device estate - application allow-listing, micro-segmentation, vendor-attested patching where available; (ix) tabletop the Synnovis-class shared-services compromise scenario with executive and clinical leadership to test patient-safety playbooks.

Disrupt

10. Forward outlook

Looking forward to the next reporting period (20-26 Jun 2026), it is highly likely that ransomware leak-site activity against UK and EU healthcare providers will sustain at the established cadence. It is likely that the Citrix NetScaler defects will produce at least one publicly disclosed exploitation event against a UK NHS or private-healthcare estate within the next two reporting cycles. It is a realistic possibility that a UK shared-services pathology or diagnostics compromise of Synnovis-scale will occur within Q3 or Q4 2026. AI-orchestrated phishing against clinicians and finance staff will continue to mature.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.