Healthcare threat intelligence report — 20–26 June 2026

• Reference: TI-2026-0626-005 (public edition)
• Sector: Healthcare
• Reporting period: 20–26 June 2026
• Issued: 26 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Healthcare sector during the period 20 Jun 2026 - 26 Jun 2026. It is intended to support NHS Trust IT, private-hospital and primary-care IT functions, medical-device security teams and the senior information risk owner, and is graded TLP:CLEAR. The dominant collection theme this period is continued aftermath reporting from the June 2026 London hospital ransomware incident, edge-appliance exposure introduced by the 23 June Ubiquiti UniFi OS KEV addition (operationally significant for hospital estates with widespread UniFi deployment), and sustained Qilin and Akira leak-site activity against healthcare-adjacent organisations.

Healthcare cyber-resilience reporting continues to highlight the asymmetric impact of attacks: the June 3 London hospital ransomware incident postponed more than 6,000 appointments and procedures, demonstrating the operational fragility of the sector to encryption and data-theft events.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that ransomware operators - Qilin, Akira, LockBit 5.0 and the Anubis cluster - will continue to drive the majority of materially-disruptive incidents against UK and EU healthcare organisations through Q3 2026, consistent with sustained 2026 leak-site activity and the June 3 London hospital incident (HIGH confidence).
2. It is highly likely that the three Ubiquiti UniFi OS defects added to KEV on 23 June will be exploited against unpatched hospital back-office and clinic-network UniFi deployments within the next 14 days (HIGH confidence).
3. It is highly likely that the Lantronix EDS5000 defect (CVE-2025-67038) will be exploited against medical-device serial-to-IP bridges and legacy hospital OT estates within the next two reporting cycles, given the device's prevalence in legacy clinical-engineering environments (MEDIUM-HIGH confidence).
4. It is highly likely that BEC and impersonation against hospital finance functions, supplier-payment teams and pharmacy-procurement teams will continue at sustained volume through the summer period (HIGH confidence).
5. It is a realistic possibility that the June 3 London hospital incident actor will repeat the targeting pattern against another UK Trust or private-hospital provider within the next two reporting cycles, given the operational-impact reward of healthcare targeting (MEDIUM confidence).

2. Sector threat landscape

The UK and EU healthcare vertical is acutely exposed to cyber risk because of the asymmetric operational and patient-safety consequences of disruption. The June 3 London hospital ransomware incident postponed more than 6,000 appointments and procedures and resulted in publication of 400GB of patient names, dates of birth, NHS numbers and blood-test results. That event continues to anchor sector reporting and informs the threat model for the current period.

The collection picture this period is dominated by the 23 June Ubiquiti UniFi OS KEV addition (operationally significant because UniFi hardware is extensively deployed in hospital back-office, clinic, GP-surgery and dental-practice estates), the Lantronix EDS5000 KEV addition (relevant to legacy medical-device serial-to-IP bridges still in clinical-engineering inventories), and continued ransomware leak-site activity from Qilin and Akira against healthcare-adjacent organisations.

Healthcare-specific ransomware activity continued at elevated levels. Qilin remains the dominant volume leader and has historical healthcare targeting (the 2024 Synnovis pathology-services attack affecting NHS London remains the canonical UK reference). Akira and LockBit 5.0 are both active against healthcare-adjacent professional services. The Anubis cluster's targeting of critical-infrastructure operators - including the 13 June Adriatic Port Authority incident - is structurally similar to healthcare targeting and the threat model should treat the cluster as cross-sector.

Medical-device security remains a structural concern. Legacy clinical-engineering inventories continue to include unpatched Windows XP / Windows 7 imaging modalities, infusion pumps, ventilators and monitoring devices that cannot be patched without vendor re-validation. Serial-to-IP bridges (including Lantronix EDS5000) are commonly used to network these legacy devices, placing the CVE-2025-67038 defect directly in scope for healthcare clients with such inventories.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + leak-site extortion
• Sector Targeting: Manufacturing, energy, financial services, healthcare, professional services, retail
• Geographic Focus: Global; sustained EU and UK targeting through 2026
• Signature TTPs: Initial access via phishing and exposed VPN / RDP; abuse of valid accounts; rapid AD escalation; data exfiltration via Rclone to Mega / Backblaze prior to encryption
• Tooling / Malware Families: Qilin / Agenda ransomware (Rust and Go builders), Cobalt Strike, AnyDesk, Rclone, PsExec
• Recent Activity: 22 Jun leak-site posting of Central Bank of Libya; sustained volume leadership across the reporting period (Insikt / ransomware.live)
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567 (some Microsoft attribution overlaps)
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + extortion
• Sector Targeting: Financial services, professional services, manufacturing, education, legal, retail
• Geographic Focus: Global; consistent UK / EU presence
• Signature TTPs: Initial access via Cisco ASA / FTD SSL VPN brute force and exposed admin panels; abuse of valid accounts; rapid network mapping; ChaCha20 ransomware encryption
• Tooling / Malware Families: Akira ransomware (Linux and Windows variants), AnyDesk, RustDesk, WinSCP, Mimikatz
• Recent Activity: 22 Jun NTD Apparel posted to leak site; continued mid-week activity against professional-services sub-verticals
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: HIGH

LockBit 5.0

• Aliases: LockBit, LockBit Black, LockBit Green, LockBit 5.0 (Aug 2025 relaunch)
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + extortion
• Sector Targeting: Financial services, healthcare, manufacturing, government contractors, legal services
• Geographic Focus: Global; consistent UK / EU / NA volume
• Signature TTPs: Initial access via exposed RDP, public-facing exploits, valid accounts; ESXi-specific encryptor build; double-extortion via leak site
• Tooling / Malware Families: LockBit 5.0 encryptor (Win/Linux/ESXi variants), StealBit exfiltrator, Cobalt Strike, Mimikatz
• Recent Activity: Continuing 2026 leak-site activity post-relaunch; selective targeting of FS, legal and contractor sub-verticals
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: MEDIUM-HIGH

Anubis ransomware

• Aliases: Anubis (2026 cluster - distinct from earlier Anubis Android banker)
• Suspected Origin: Russian-speaking criminal underground (assessed)
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - extortion + leak-site
• Sector Targeting: Maritime port authorities, logistics, healthcare, manufacturing
• Geographic Focus: EU primary, expanding global
• Signature TTPs: Phishing-led initial access; data theft prior to encryption; high-value extortion demands against critical-infrastructure operators
• Tooling / Malware Families: Anubis ransomware, custom .NET loaders, Cobalt Strike
• Recent Activity: 13 Jun attack on Adriatic Port Authority (EU) reported by Resecurity; sustained presence over the reporting period
• Assessed Threat to Vertical: HIGH for maritime / logistics, MEDIUM elsewhere
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

*Detection engineering should treat the Ubiquiti UniFi OS chain, the Lantronix EDS5000 HTTP RPC interface and the Qilin / Akira tradecraft set as the principal hunting hypotheses for this period. For healthcare-specific patterns, hunt for bulk-export activity against EPR systems (Epic, Cerner, Lorenzo, EMIS), against PACS / RIS imaging archives and against pharmacy systems.

Defend

Preventive priorities follow Section 6 directly. Ubiquiti UniFi OS 5.0.8 patch must be applied across the healthcare estate by 26 June to meet CISA BOD 26-04 - prioritise hospital back-office, clinic and surgery edge estates. Lantronix EDS5000 firmware update applies similarly to legacy clinical-engineering inventories; where firmware update is not viable without device re-validation, immediately remove from internet exposure and segregate to dedicated OT VLAN with restrictive ACLs. For identity hardening across hospital M365 tenants, enforce number-matching MFA, block legacy authentication, and ensure clinical-staff account-recovery procedures cannot be triggered without out-of-band identity verification. Ensure immutable, off-premises backups exist for EPR, PACS and pharmacy systems and that recovery time objectives are tested against the June 3 London incident impact baseline. Audit pharmacy-procurement payment-authorisation procedures for BEC resilience.

Disrupt

Disruption activity within client lawful authority should focus on: (i) participation in the Health Information Sharing and Analysis Centre (H-ISAC), the NHS Cyber Associates Network and the NCSC CiSP healthcare community, with this week's IP Insights critical / block tail submitted as the highest-value contributable; (ii) coordination with NHS England Cyber Operations on the Ubiquiti UniFi OS chain and the Lantronix EDS5000 defect across NHS supplier estates; (iii) takedown coordination via NCSC ACD for hospital-themed phishing infrastructure; (iv) submission of observed bulk-EPR-exfiltration indicators to H-ISAC and to ipinsights.io; (v) coordination with clinical-engineering teams to inventory Lantronix-attached medical devices and to engage device vendors on patch availability.

10. Forward outlook

Looking forward to the next reporting period (27 Jun - 03 Jul 2026), it is likely that at least one UK or EU healthcare organisation will publicly disclose a ransomware or data-theft incident traceable to one of the Ubiquiti UniFi OS chain, the Lantronix EDS5000 defect or the Citrix NetScaler defects in Section 6. Qilin and Akira leak-site activity against healthcare-adjacent organisations is highly likely to continue at the current cadence with at least one further healthcare-adjacent posting expected.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.