CVE-2026-17583 — High-Severity Tampering Flaw in Thermo Fisher Applied Biosystems Forensic DNA Analysis Software

Key facts for Thermo Fisher HID DNA tampering

Detection coverage for Thermo Fisher HID DNA tampering

As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1854 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthorized Modification of Forensic DNA Evidence Files (.fsa/.hid)

Detects modification of .fsa/.hid forensic DNA evidence files by processes other than authorized Thermo Fisher instrument software (GeneMapper_IDX.exe, 3500_DataCollection.exe, SeqStudio.exe). Per CVE-2026-17583, the core vulnerability is that analysis software accepts modified ABIF files without integrity verification. Modification by any process outside the authorized instrument pipeline indicates data manipulation (T1565.001) — the central attack technique of this CVE.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1565.001, T1485
• Data sources: sysmon_file_write, sysmon_file_creation, edr_file_modification_events
• Severity: critical
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog" EventCode=2 (TargetFilename="*.fsa" OR TargetFilename="*.hid")
| eval process_name=mvindex(split(Image,"\\"),-1)
| search process_name!="GeneMapper_IDX.exe" process_name!="3500_DataCollection.exe" process_name!="3730_DataCollection.exe" process_name!="SeqStudio.exe" process_name!="SeqStudioFlex.exe"
| stats values(TargetFilename) as modified_files values(Image) as process_by values(UserID) as users by Computer
| eval file_count=mvcount(modified_files)
| where file_count >= 1
| table Computer process_by modified_files users
| sort - file_count

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileModified"
| where FolderPath contains ".fsa" or FolderPath contains ".hid"
| extend ProcessName = tostring(split(FolderPath, "\\")[-1])
| where InitiatingProcessFileName !in~ ("GeneMapper_IDX.exe", "3500_DataCollection.exe", "3730_DataCollection.exe", "SeqStudio.exe", "SeqStudioFlex.exe")
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, AccountName, SHA1
| order by Timestamp desc

Sigma

title: Unauthorized Process Modified Forensic DNA Evidence File
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: Detects when a process other than authorized Thermo Fisher instrument software modifies a .fsa or .hid forensic DNA evidence file. This is the central exploitation indicator for CVE-2026-17583, where ABIF files lack cryptographic integrity verification and can be tampered with by any process with file-write access.
references:
  - "https://attack.mitre.org/techniques/T1565.001/"
  - "https://nvd.nist.gov/vuln/detail/CVE-2026-17583"
  - "https://attack.mitre.org/techniques/T1036/"
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-04
tags:
  - attack.defense_evasion
  - attack.t1565.001
  - attack.t1036
  - cve.2026.17583
logsource:
  category: file_change
  product: windows
  definition: Requires Sysmon EventCode 2 (FileWrite) or equivalent EDR file modification telemetry targeting .fsa/.hid file extensions
detection:
  selection:
    TargetFilename|endswith:
      - ".fsa"
      - ".hid"
    EventCode: 2
  filter_authorized:
    Image|endswith:
      - "\\GeneMapper_IDX.exe"
      - "\\3500_DataCollection.exe"
      - "\\3730_DataCollection.exe"
      - "\\SeqStudio.exe"
      - "\\SeqStudioFlex.exe"
  condition: selection and not filter_authorized
falsepositives:
  - "Laboratory backup or archiving software touching file metadata during backup operations"
  - "Antivirus or FIM software scanning forensic evidence storage"
  - "File copy operations for legitimate case file migration to archive"
level: critical

Known false positives:

• Backup/archiving software modifying file metadata on evidence storage
• Antivirus or file integrity monitoring scans touching evidence file contents
• Authorized migration of case files between storage tiers

Tuning notes: Build an allowlist of authorized Thermo Fisher instrument processes for the specific lab environment. For EOL instruments (3130, ABI PRISM) that cannot be patched, monitoring unauthorized file modification becomes the primary compensating detection. Consider adding SHA-256 baseline comparison for high-value evidence files.

• 🔒 Binary Manipulation Tools Executed on Forensic Lab Systems · unlock with TL Creds
• 🔒 Evidence File Timestamp Manipulation and Event Log Clearing on Lab Systems · unlock with TL Creds
• 🔒 Forensic Evidence File Staging and Exfiltration · unlock with TL Creds
• 🔒 Custom ABIF Binary Tampering Script Execution · unlock with TL Creds
• 🔒 ABIF Binary Structure Manipulation via API Call Patterns · unlock with TL Creds
• 🔒 Anomalous Outbound Network Connections from Forensic Lab Infrastructure · unlock with TL Creds
• 🔒 RDP Remote Access to Forensic Lab Workstations with Evidence File Access · unlock with TL Creds
• 🔒 Bulk Forensic Evidence File Access via Network Shares (SMB) · unlock with TL Creds

Indicators of compromise for Thermo Fisher HID DNA tampering

As of 2026-08-04, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-1854.

How Thermo Fisher HID DNA tampering works

The vulnerability likely existed since ~1995 with no known exploitation in the wild as of disclosure.

## Overview

CVE-2026-17583 is a high-severity (CVSS 8.2, CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) file integrity vulnerability affecting Thermo Fisher Scientific's Applied Biosystems Human Identification (HID) software product line — the dominant forensic DNA analysis platform used by crime laboratories across the United States and internationally. The flaw resides in the absence of cryptographic integrity verification between the instrument data collection layer and the analysis software: .fsa (fragment analysis) and .hid (Human IDentification) output files are accepted by analysis software (GeneMapper ID-X, 3500/3500xL Data Collection Software, 3730/3730xL Data Collection Software, SeqStudio) without any check tying the digital record to the producing instrument. An attacker who gains access to a laboratory's systems — locally or remotely — can modify these binary files before they are ingested by analysis software, and the alterations will be virtually impossible to detect through normal forensic review.

## Technical Details: ABIF File Format

Both .fsa and .hid files use the proprietary ABIF (Applied Biosystems Inc. Format) binary container format, the same underlying format as .ab1 sequencing files. An ABIF file consists of three logical sections: (1) a 128-byte header containing the ASCII signature 'ABIF' (0x41424946) at bytes 0-3, a version field (typically 101 for v1.01), a numelements field at bytes 18-21 (SInt32), and a dataoffset field at bytes 22-25 (SInt32) pointing to the directory array; (2) a directory array of 28-byte DirEntry structures — each containing a 4-byte tag name (e.g., 'DATA' for raw fluorescence trace data, 'PLOC' for peak location data, 'APrX1' for analysis parameter XML), a tag number (SInt32), element type code (SInt16), element size (SInt16), number of elements (SInt32), data size (SInt32), and data offset (SInt32) pointing into the data section; and (3) the raw data payload containing tagged items such as fluorescence trace data from up to 12 dye channels (DATA1-DATA12), peak location data (PLOC1-PLOC2), instrument identification (MCHN), sample container identifier (CTID), and analysis parameter XML (APrX1). All integers are big-endian. Critically, there is no embedded digital signature, checksum, or cryptographic hash across the file contents — the file format predates modern integrity requirements, with researchers assessing it has been deployed since approximately 1995.

## Attack Vector

An attacker with file-write access to a laboratory server or workstation can execute a multi-step tampering operation: (1) use valid accounts (T1078) or external remote services (T1133) to gain initial access to the laboratory's IT environment; (2) discover target .fsa and .hid evidence files through file and directory discovery (T1083); (3) copy or read the target files from the local system (T1005); (4) use a hex editor or custom scripting tool — potentially AI-generated — to modify the ABIF binary data structure (T1059.007), specifically: alter raw DATA fluorescence trace values to add or remove allele contributions, modify PLOC peak location entries to change called alleles, rewrite APrX1 analysis parameter XML to alter instrument metadata and sample identification, and adjust file timestamps to masquerade as untouched originals (T1036); (5) optionally clear Windows Event Logs (T1070.001) to cover forensic tracks; and (6) load the tampered file back into GeneMapper ID-X or other analysis software, which will process the modified data without triggering any integrity warning. The tampered file can combine DNA profiles from multiple individuals, fabricate or eliminate a suspect's profile, alter sample attribution, or corrupt evidence rendering it unusable (T1485 — Data Destruction).

Researcher Nathan Adams (Forensic Bioinformatics) demonstrated this attack using Anthropic's Claude AI to write the file modification code in approximately 45 minutes. The demonstration merged capillary electrophoresis scans from two individuals' DNA profiles into a single output file that appeared untouched since 2015 and raised no warnings when loaded into standard forensic analysis software. This highlighted how AI dramatically lowers the technical barrier to crafting such tampering tools.

## Affected Products and Patching

Five currently supported product lines received patches (July 31, 2026) that introduce digital signature verification, allowing laboratories to cryptographically validate that a data file has not been altered since it left the instrument:

- 3500/3500xL Series Data Collection Software (fixed v4.0.3) - 3730/3730xL Series Data Collection Software (fixed v5.0.3) - SeqStudio Genetic Analyzer Data Collection Software (fixed v1.2.6) - SeqStudio Flex Series Instrument Software (fixed v1.2.1) - GeneMapper ID-X Software (fixed v1.7.4)

SeqStudio Flex users with Secure Analytics Environment (SAE) must install the latest SAE profile via the SAE Admin Console before applying the update.

Three end-of-life products receive no patch and remain permanently exposed: 3130 Series Data Collection Software 4.1 and earlier, ABI PRISM 3100/3100-Avant Data Collection Software 2.0 and earlier, and ABI PRISM 310 Data Collection Software 3.1 and earlier.

## Evidentiary and Legal Implications

The vulnerability creates a critical gap in the forensic evidence chain of custody. Digital DNA evidence files underpin criminal investigations, paternity testing, missing-person identification, and mass-casualty victim identification worldwide. Because the digital signatures operate only on files created after the patch is applied, roughly 30 years of existing digital forensic files cannot be retroactively validated. There is currently no known method to detect tampering in historical case files. This raises significant challenges for evidence admissibility, cold-case reviews, and the integrity of conclusions drawn from legacy digital evidence. Laura Gaydosh Combs (University of New Haven) noted that these data files 'lack the same level of tamper-evident markings that we require for a paper bag.'

## Mitigation and Compensating Controls

For laboratories unable to immediately patch or operating end-of-life instruments, Thermo Fisher recommends: maintaining secure chain-of-custody documentation for all evidence files; storing files on encrypted and password-protected media (encrypted USB drives or hard drives); restricting file access to authorized personnel only with least-privilege permissions on HID instrumentation systems; using firewall rules or network access control lists to limit connectivity to trusted sources; and employing third-party analysis platforms for cross-validation. A longer-term strategy should include replacing end-of-life instruments with supported models that receive integrity updates.

## Disclosure and Status

The vulnerability was identified and disclosed through CISA-coordinated responsible disclosure by researchers Nathan Adams (Forensic Bioinformatics), Kevin Dyer, and Laura Gaydosh Combs (University of New Haven). Thermo Fisher privately acknowledged the report in July 2026, and the security bulletin was published on July 31, 2026. The company stated it has found no evidence of exploitation in the wild as of the disclosure date. The CVE was not yet published on NVD detail pages or listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of early August 2026. The disclosure has prompted broader scrutiny of cybersecurity practices across the forensic science industry, where no centralized regulator currently oversees laboratory information security, resulting in a patchwork of security measures across over 200 U.S. crime laboratories.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

exfiltration

T1020 Automated Exfiltration

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Impact

T1485 Data Destruction

impact

T1565 Data Manipulation

Remediation for Thermo Fisher HID DNA tampering

Patches

• 3500/3500xL Series Data Collection Software v4.0.3
• 3730/3730xL Series Data Collection Software v5.0.3
• SeqStudio Genetic Analyzer Data Collection Software v1.2.6
• SeqStudio Flex Series Instrument Software v1.2.1
• GeneMapper ID-X Software v1.7.4

Immediate actions

• Apply Thermo Fisher security updates to all supported product lines (3500/3500xL v4.0.3, 3730/3730xL v5.0.3, SeqStudio v1.2.6, SeqStudio Flex v1.2.1, GeneMapper ID-X v1.7.4)
• SeqStudio Flex users: install latest SAE profile via SAE Admin Console before applying update
• Implement SHA-256 hash logging at instrument generation time for all .fsa/.hid evidence files
• Review recent case files for signs of modification against chain-of-custody logs
• Inventory all HID instruments in the laboratory fleet to identify EOL models requiring compensating controls

Workarounds

• Maintain strict chain-of-custody documentation for all digital evidence files from generation through analysis
• Store .fsa and .hid files exclusively on encrypted, password-protected removable media
• Apply least-privilege access controls on all HID instrumentation systems and shared network storage
• Implement network segmentation with firewall ACLs limiting instrument and analysis workstation connectivity to trusted sources only
• Use independent third-party analysis platforms for cross-validation of critical evidentiary DNA profiles
• Maintain offline backup copies of original instrument output files before any analysis processing occurs
• Enable Windows security auditing, file access logging, and event log forwarding to SIEM on all lab workstations and file servers
• Conduct periodic integrity audits comparing instrument-side file hashes against analysis-side hashes

Longer-term hardening

• Retire or air-gap end-of-life instruments (3130 Series, ABI PRISM 3100/3100-Avant, ABI PRISM 310) and replace with supported models
• Deploy file integrity monitoring (FIM) on all forensic analysis workstations and shared evidence storage
• Establish centralized cybersecurity oversight and incident response capability for forensic laboratory IT infrastructure
• Implement cryptographic hash chaining for digital evidence: register file hashes at generation in an immutable audit log
• Develop standard operating procedures for re-analyzing legacy evidence through multiple independent analysis platforms
• Advocate for standardized tamper-evident digital evidence format requirements across all forensic instrument manufacturers

Affected and fixed versions

• Thermo Fisher Scientific — Applied Biosystems 3500/3500xL Data Collection Software
  Vulnerable versions: 4.0.2 and earlier
  Fixed in: 4.0.3
• Thermo Fisher Scientific — Applied Biosystems 3730/3730xL Data Collection Software
  Vulnerable versions: 5.0.2 and earlier
  Fixed in: 5.0.3
• Thermo Fisher Scientific — Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software
  Vulnerable versions: 1.2.5 and earlier
  Fixed in: 1.2.6
• Thermo Fisher Scientific — Applied Biosystems SeqStudio Flex Series Instrument Software
  Vulnerable versions: 1.2.0 and earlier
  Fixed in: 1.2.1
• Thermo Fisher Scientific — Applied Biosystems GeneMapper ID-X Software
  Vulnerable versions: 1.7.3 and earlier
  Fixed in: 1.7.4
• Thermo Fisher Scientific — Applied Biosystems 3130 Series Data Collection Software
  Vulnerable versions: 4.1 and earlier (end-of-life, no patch)
• Thermo Fisher Scientific — Applied Biosystems ABI PRISM 3100/3100-Avant Data Collection Software
  Vulnerable versions: 2.0 and earlier (end-of-life, no patch)
• Thermo Fisher Scientific — Applied Biosystems ABI PRISM 310 Data Collection Software
  Vulnerable versions: 3.1 and earlier (end-of-life, no patch)

Timeline of Thermo Fisher HID DNA tampering

• 1995-01-01 Applied Biosystems introduces the ABIF binary file format for genetic analysis data (.fsa, .hid, .ab1); the format specification does not include any cryptographic integrity verification mechanism, establishing the structural weakness that would underpin CVE-2026-17583
• 2026-05-01 Researchers Nathan Adams (Forensic Bioinformatics), Kevin Dyer, and Laura Gaydosh Combs (University of New Haven) begin investigating the integrity of digital DNA evidence files in the Applied Biosystems HID workflow
• 2026-05-15 Researchers discover the file integrity vulnerability and report it through CISA's coordinated vulnerability disclosure process
• 2026-06-01 Nathan Adams successfully demonstrates the exploit using Anthropic's Claude AI to write the file modification code in approximately 45 minutes; merges two individuals' DNA profiles into a single .fsa file appearing untouched since 2015 with no warnings in analysis software
• 2026-07-01 Thermo Fisher Scientific privately acknowledges the vulnerability report after internal validation and begins patch development
• 2026-07-31 CISA issues coordinated vulnerability disclosure notice confirming responsible disclosure and no evidence of exploitation in the wild. CVE not listed in CISA Known Exploited Vulnerabilities catalog.
• 2026-07-31 CVE-2026-17583 published with CVSS v4.0 base score of 8.2 (HIGH). Thermo Fisher publishes security bulletin and releases patches for 5 supported product lines introducing digital signature verification for .fsa/.hid file integrity. Three end-of-life product lines (3130 Series, ABI PRISM 3100/3100-Avant, ABI PRISM 310) receive no fix.
• 2026-08-01 The Hacker News, The Verge, TechRadar, and TNW publish articles covering the vulnerability and the 30-year forensic DNA evidence integrity gap
• 2026-08-03 Wall Street Journal covers the vulnerability, reporting Adams' demonstration and Thermo Fisher's statement that no exploitation in the wild had been found
• 2026-08-03 Cybersecurity News, Daily Security Review, and HEAL Security publish detailed technical analyses. Laura Gaydosh Combs publicly states forensic data files 'lack the same level of tamper-evident markings that we require for a paper bag.' Nathan Adams story reported including his use of Anthropic's Claude to write the exploit code.
• 2026-08-04 CVE-2026-17583 not yet published on NVD detail pages; no confirmed exploitation in the wild; forensic science community begins reviewing cybersecurity practices across 200+ US crime laboratories

Sources cited for Thermo Fisher HID DNA tampering

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-08-04
• NVD — CVE-2026-17583 NVD (NIST) · Advisory · 2026-07-31
• CISA Coordinated Vulnerability Disclosure Process CISA · Government advisory · 2026-07-31
• Thermo Fisher Applied Biosystems Security Bulletin — July 31, 2026 corporate.thermofisher.com · Vendor report · 2026-07-31
• ABIF File Format Specification — Applied Biosystems archive.gfjc.fiu.edu · Research · 1995-01-01
• DNA Test Software Flaw Could Let Attackers Tamper With Forensic Evidence cybersecuritynews.com · News · 2026-08-03
• Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable The Hacker News · News · 2026-08-03
• A flaw in crime-lab software let AI rewrite DNA evidence thenextweb.com · News · 2026-08-03
• CVE-2026-17583 — Daily Security Review dailysecurityreview.com · News · 2026-08-03
• A security flaw in widely used crime-lab equipment exposed digital DNA evidence to undetectable tampering theverge.com · News · 2026-08-03
• DNA samples from crime-scene forensics can be modified and switched using an AI tool techradar.com · News · 2026-08-03
• DNA Test Software Vulnerability Allows Attackers to Alter Analysis Data healsecurity.com · News · 2026-08-03
• Wall Street Journal — DNA Evidence Flaw Allows Tampering, Researchers Say wsj.com · News · 2026-08-03

Threats related to Thermo Fisher HID DNA tampering

• White House Authorizes Private US Companies to Conduct Offensive Cyber Operations Against Foreign Criminal Networks (NSPM: "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime")