In the healthcare sector, the integrity of diagnostic and forensic data is not just an IT metric—it is a matter of patient safety and justice. CISA has released advisory ICSMA-26-216-01, detailing critical security issues in Thermo Fisher Scientific’s Applied Biosystems Genetic Analyzers. This advisory highlights a disturbing capability for attackers to modify .fsa and .hid output files. These formats contain raw electropherogram data, essentially the digital representation of DNA sequences.
Successful exploitation of these vulnerabilities could result in the tampering of genetic data, leading to inaccurate test results. Whether in a clinical setting or a forensic laboratory, the implications are severe. Defenders must act immediately to identify vulnerable assets and secure the output chains of these devices.
Technical Analysis
The core of the issue lies in the manipulation of proprietary data files generated by Thermo Fisher's Data Collection Software and associated analysis tools.
The Vulnerability
The advisory indicates that an attacker can modify .fsa (Fluorescence Spectrogram Analysis) and .hid (Hidden or Data Identification) files. This suggests a breakdown in file integrity controls—either the software fails to validate file signatures upon loading, or the permissions on the underlying filesystem allow unauthorized modification by non-service accounts. By tampering with these files, an attacker can alter the peaks and signals interpreted by the analyst or the automated software, effectively changing the DNA result without leaving an obvious trace in the user interface of the analysis software.
Affected Products and Versions The vulnerability spans a wide range of legacy and current hardware generations:
- Applied Biosystems 3500/3500xL Series: Data Collection Software <= 4.0.2
- Applied Biosystems 3730/3730xL Series: Data Collection Software <= 5.0.2
- Applied Biosystems SeqStudio: Data Collection Software <= 1.2.5
- Applied Biosystems SeqStudio Flex: Instrument Software <= 1.2.0
- Applied Biosystems GeneMapper ID-X: Software <= v1.7.3
- Applied Biosystems 3130 Series: Data Collection Software <= 4.1
- ABI PRISM 3100/3100-Avant: Data Collection Software <= 2.0
- ABI PRISM 310: Data Collection Software <= 3.1
Exploitation Context While the specific vector (e.g., local access vs. network share) is not detailed in the summary, these instruments are frequently connected to network shares for data backup or analysis. If an attacker gains a foothold in the lab network, they could scan for these specific file extensions and alter them in transit or at rest. Because these files are often treated as "pure data," they may bypass standard malware scanning that focuses on executables.
Detection & Response
Detecting the tampering of these files requires a shift in mindset. We are not just looking for malware execution; we are looking for unauthorized modifications to high-value scientific data artifacts.
Sigma Rules
The following Sigma rules focus on the integrity of .fsa and .hid files. The first rule detects modifications to these files by processes other than the legitimate software (a heuristic approach). The second rule detects the creation of these files on network shares, which is a common data exfiltration or staging point.
---
title: Potential Tampering of Thermo Fisher Genetic Data Files
id: a8b9c0d1-2e3f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects modification of .fsa or .hid files (Genetic Analyzer data) by processes other than the expected software binaries. Unauthorized modification indicates data integrity attacks.
author: Security Arsenal
date: 2026/04/06
tags:
- attack.impact
- attack.t1565.001
logsource:
category: file_change
product: windows
detection:
selection:
TargetFilename|endswith:
- '.fsa'
- '.hid'
filter_main_legit_software:
Image|contains:
- 'Data Collection Software'
- 'SeqStudio'
- 'GeneMapper'
condition: selection and not filter_main_legit_software
falsepositives:
- Legitimate backup software interacting with files
- Administrative file moves
level: high
---
title: Creation of Genetic Analyzer Output on Network Share
id: b9c0d1e2-3f4a-5b6c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the creation of .fsa or .hid files on remote shares. Monitoring the egress of sensitive genetic data helps identify unauthorized staging or bulk access.
author: Security Arsenal
date: 2026/04/06
tags:
- attack.collection
- attack.t1074.001
logsource:
category: file_create
product: windows
detection:
selection:
TargetFilename|endswith:
- '.fsa'
- '.hid'
filter_network:
TargetFilename|startswith: \\\
condition: selection and filter_network
falsepositives:
- Authorized backups to NAS/SAN
- Normal data transfer workflows
level: medium
KQL (Microsoft Sentinel)
Use this KQL query to hunt for modifications to these specific file extensions across your endpoint estate. This is crucial for identifying if a broad compromise is affecting data integrity.
DeviceFileEvents
| where ActionType in ("FileCreated", "FileModified", "FileDeleted")
| where FileName has_any (".fsa", ".hid")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
Velociraptor VQL
This VQL artifact hunts for the presence of these high-value files on the disk. In an incident response scenario, collecting these files for hash comparison against a known-good baseline (if available) is a critical step in verifying data integrity.
-- Hunt for Thermo Fisher Genetic Data Files
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/*.fsa', '/**/*.hid')
WHERE Mtime > now() - 30d
-- Limit to recent modifications to find potential tampering
Remediation Script (PowerShell)
This script scans the system for the installed Thermo Fisher software versions listed in the advisory to identify assets that require patching. It checks the file properties of common executable paths associated with the vulnerable software.
# Check for Thermo Fisher Applied Biosystems Vulnerable Versions
# Based on ICSMA-26-216-01
$VulnerableSoftware = @(
@{Name="3500/3500xL Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\3500 Data Collection Software\DataCollection.exe"; MaxVer="4.0.2"},
@{Name="3730/3730xL Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\3730 Data Collection Software\DataCollection.exe"; MaxVer="5.0.2"},
@{Name="SeqStudio Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\SeqStudio Data Collection Software\SeqStudio.exe"; MaxVer="1.2.5"},
@{Name="SeqStudio Flex"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\SeqStudio Flex Software\SeqStudioFlex.exe"; MaxVer="1.2.0"},
@{Name="GeneMapper ID-X"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\GeneMapperID-X\GeneMapperID-X.exe"; MaxVer="1.7.3"},
@{Name="3130 Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\3130 Data Collection Software\DataCollection.exe"; MaxVer="4.1"},
@{Name="ABI PRISM 3100 Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\3100 Data Collection Software\DataCollection.exe"; MaxVer="2.0"},
@{Name="ABI PRISM 310 Data Collection"; Path="${env:ProgramFiles(x86)}\Applied Biosystems\310 Data Collection Software\DataCollection.exe"; MaxVer="3.1"}
)
Write-Host "Scanning for Thermo Fisher Applied Biosystems Vulnerable Software..." -ForegroundColor Cyan
foreach ($app in $VulnerableSoftware) {
if (Test-Path $app.Path) {
try {
$fileInfo = Get-Item $app.Path
$versionInfo = $fileInfo.VersionInfo.FileVersion
Write-Host "[FOUND] $($app.Name) detected at path: $($app.Path)" -ForegroundColor Yellow
Write-Host " Installed Version: $versionInfo (Vulnerable if <= $($app.MaxVer))" -ForegroundColor White
# Note: Simple string comparison logic for demonstration; strict version parsing requires .NET Version objects
}
catch {
Write-Host "[ERROR] Could not read version info for: $($app.Path)" -ForegroundColor Red
}
}
}
Write-Host "Scan complete. Please check the output against the advisory versions." -ForegroundColor Green
Remediation
- Patch Immediately: Contact Thermo Fisher Scientific support or visit their customer portal to obtain the latest patches for all affected versions listed above. Prioritize internet-facing systems or those connected to general-purpose networks.
- Verify Data Integrity: If you suspect exploitation, conduct a forensic review of
.fsaand.hidfiles generated during the suspected window. Compare file hashes against backup copies if available. - Network Segmentation: Ensure Genetic Analyzers reside on an isolated VLAN (OT network) strictly separated from the IT network. Access to these devices should be restricted to specific lab workstations, not general user laptops.
- Disable Unnecessary Services: If the specific software version requires specific network ports for data transfer, ensure firewall rules restrict access strictly to necessary IPs.
- Review Access Controls: Audit the file system permissions on the directories where
.fsaand.hidfiles are stored. Ensure that write access is restricted strictly to the service account running the Data Collection Software and designated lab administrators.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.