Healthcare threat intelligence report — 27 June – 3 July 2026

• Reference: TI-2026-0703-005 (public edition)
• Sector: Healthcare
• Reporting period: 27 June – 3 July 2026
• Issued: 3 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Healthcare sector during the period 27 Jun 2026 - 03 Jul 2026. It is intended to support operational defenders and risk owners in NHS trusts, independent healthcare providers, private clinics, healthcare technology suppliers and adjacent organisations and is graded TLP:CLEAR. Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE), continued long-tail impact of the Synnovis / Qilin June 2024 attack on NHS South East London, and sustained ransomware activity by Qilin against healthcare-adjacent targets.

The perimeter tail is dominated by IP Insights critical-scored Tor exits and bulletproof hosting, with sustained volumes against Entra ID sign-in endpoints on NHS-adjacent tenants.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-45659 will be exploited against unpatched SharePoint estates in NHS trusts, independent healthcare providers and clinical technology suppliers within the next 14 days (HIGH confidence).
2. It is highly likely that Qilin will continue to represent the single largest ransomware threat to UK healthcare over the next two reporting cycles, consistent with the Synnovis / NHS South East London 2024 pattern and Qilin's continued dominance of the leak-site scene in H1 2026 (HIGH confidence).
3. It is likely that ransomware attacks on healthcare technology suppliers (pathology, imaging, GP-software, pharmacy dispensing) will continue at elevated volumes, with sector-wide downstream impact when they succeed (HIGH confidence).
4. It is likely that data-extortion attacks on private healthcare providers holding sensitive patient data will continue, given the sensitivity of the data and the regulatory / reputational leverage this gives extortion actors (MEDIUM-HIGH confidence).
5. It is a realistic possibility that state-sponsored actors will conduct intelligence-gathering intrusions against UK healthcare research institutions during Q3 2026, consistent with historical PRC and Russian targeting (MEDIUM confidence).

2. Sector threat landscape

The healthcare sector remains one of the highest-impact targets for ransomware globally, both because the operational consequences of downtime are directly life-threatening and because the sensitivity of the data provides extreme leverage in extortion negotiations. The long-tail impact of the June 2024 Synnovis / Qilin attack on NHS South East London continues to be documented: recent reporting confirms that at least one NHS trust is still working without fully restored systems 18 months on, with c. 161,560 pathology reports still queued for backfill into patient records.

CVE-2026-45659 is operationally significant for healthcare. SharePoint is widely deployed across NHS trusts for clinical governance documentation, incident reporting, policies and procedures, and back-office collaboration; it is also widely deployed in independent healthcare providers and clinical technology suppliers. Successful exploitation gives an authenticated attacker RCE on the SharePoint server, which in typical healthcare estates has network reachability to clinical, corporate and (in some estates) OT / medical-device networks.

Ransomware activity against healthcare and healthcare-adjacent targets continues at high volume - Qilin's Q1 2026 leak-site tally of 338 postings continues to include healthcare and healthcare-adjacent victims at a rate that suggests the sector remains a priority target. The historical Change Healthcare attack in the US (192.7m individuals affected) and the Synnovis attack in the UK have both demonstrated the sector-wide downstream impact of ransomware against a single high-leverage supplier. The NHS GP software supplier attack documented in December 2025 is a further illustration of this pattern.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed); Kremlin-tolerated per NHS incident retrospective
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Healthcare (priority), FS, manufacturing, professional services
• Geographic Focus: Global; UK healthcare notably represented
• Signature TTPs: IAB-brokered credentials, RMM abuse, RDP; Rust payload; ESXi Linux variant; sustained LOTL; heavy data-exfiltration for leverage
• Tooling / Malware Families: Qilin.B, Cobalt Strike, Rclone-to-Mega, Mimikatz, SharpHound
• Recent Activity: Sustained cadence into July 2026 per ransomware.live; Synnovis (Jun 2024) long-tail still active
• Assessed Threat to Vertical: HIGH - dominant threat to UK healthcare
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Healthcare, manufacturing, professional services
• Geographic Focus: North America and Europe
• Signature TTPs: Cisco VPN unpatched initial access, IAB credentials, RDP lateral movement, ESXi hypervisor targeting
• Tooling / Malware Families: Akira ransomware, Megazord ESXi variant, Rclone, AnyDesk
• Recent Activity: Cumulative $244m proceeds through Q1 2026; sustained sector-adjacent cadence
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: HIGH

APT41 (PRC)

• Aliases: Winnti, BARIUM, LEAD, WICKED PANDA, Brass Typhoon
• Suspected Origin: People's Republic of China
• Suspected Sponsor: Nation state (MSS-adjacent)
• Primary Motivation: Espionage (vaccine / oncology / infectious-disease research)
• Sector Targeting: Healthcare research, pharmaceutical, biotechnology, government
• Geographic Focus: Global
• Signature TTPs: Software supply-chain compromise, targeted spearphishing, valid credentials, MOONWALK / SPACEHOP / DEADEYE loaders
• Tooling / Malware Families: MOONWALK, DEADEYE, SPACEHOP, ShadowPad, PlugX, custom loaders
• Recent Activity: Continued targeting of research institutions per CISA / Mandiant / Microsoft reporting
• Assessed Threat to Vertical: MEDIUM - low volume, high strategic significance
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat CVE-2026-45659 as the principal hunting hypothesis for the next reporting cycle. Rules around w3wp.exe spawning cmd or PowerShell under the SharePoint app-pool identity, ULS log deserialisation exceptions, and Site Member-permission accounts accessing upload endpoints must be deployed. Deploy Qilin-specific initial-access hunts: RMM install activity (AnyDesk, SplashTop) on healthcare endpoints outside expected windows, DCSync activity on domain controllers, Rclone / MEGAcmd invocation on file servers. For OT-adjacent estates (medical devices, imaging modalities), extend the hunt to detection of unexpected network flows from IT segments to OT VLANs. Deploy sensitivity-labelled document access anomaly detections on patient-record repositories.

Defend

Preventive priorities follow Section 6 directly. SharePoint patching must be applied to meet the CISA KEV 04 Jul deadline. Complete NetScaler patching and session-invalidation. Deploy phishing-resistant MFA on all IT-admin, clinical-admin and privileged clinical user accounts. Verify network segmentation between IT and OT / medical device networks. Baseline data loss prevention on patient-record repositories and clinical governance stores. Review third-party supplier attack surface (pathology labs, imaging, dispensing, GP-software), including their patch posture against CVE-2026-45659, and consider requiring a supplier attestation on remediation status.

Disrupt

Disruption activity within client lawful authority should focus on: (i) participation in H-ISAC daily bulletin and indicator exchange, with this week's IP Insights critical / block tail contributed; (ii) NHS Digital / DSPT cyber alert follow-through, including the CC-4759 Citrix NetScaler alert and any subsequent CC-alerts issued during the period; (iii) coordinated take-down requests to bulletproof providers for confirmed adversary infrastructure, submitted through the NCSC Takedown Service; (iv) participation in H-ISAC and NHS Digital tabletop exercises for third-party supplier incident-response playbook validation.

10. Forward outlook

Looking forward to the next reporting period (04 Jul - 10 Jul 2026), it is likely that at least one healthcare provider or clinical technology supplier will publicly disclose a SharePoint-borne incident attributable to CVE-2026-45659. Qilin activity against healthcare is expected to remain steady, with a moderate probability of a directly-attributed UK healthcare victim posting during the period. It is a realistic possibility that a state-sponsored intrusion against a UK healthcare research institution will be publicly attributed during Q3 2026.

Trigger conditions that would prompt revision of this outlook include: (a) any publicly-disclosed UK healthcare SharePoint incident; (b) any successful Qilin intrusion against a UK healthcare provider or clinical technology supplier, which would warrant immediate out-of-cycle advisory; (c) any state-sponsored intrusion publicly attributed against UK research institutions; (d) further CISA KEV additions materially affecting healthcare infrastructure.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.