Cyber alerts - NHS England Digital

Published Tuesday 20 November 2018 (12:00) (updated 11 January 2022)

New Campaign Targeting Drupal Websites

A new attack methodology has been identified which involves the Dirty COW (CVE-2016-5195) and Drupalgeddon 2 (CVE-2018-7600) vulnerabilities present in unpatched Drupal web servers.

CC-2790 Medium

Published Wednesday 14 November 2018 (12:00) (updated 17 February 2020)

HookAds Malvertising Campaign

A new malvertising campaign known as HookAds has been observed using the Fallout exploit kit to install several other well-known malware.

CC-2768 Medium

Published Wednesday 7 November 2018 (12:00) (updated 11 January 2022)

Ransom Campaign Exploiting Open-Source Tool

A new campaign has been observed using the open-source DiskCryptor encryption tool to perform ransom attacks on targeted devices.

CC-2764 Low

Published Friday 2 November 2018 (12:00) (updated 11 January 2022)

Zombie Phishing Campaign

Zombie Phish is a newly observed phishing campaign that is using compromised email accounts to target users via conversation hijacking.

CC-2625 Medium

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

WordPress Tech Support Redirection Campaigns

New campaigns have been observed targeting outdated WordPress installations and related plugins to enrol affected users in technical support scams or redirect them to malicious sites.

CC-2668 Low

Published Thursday 13 September 2018 (12:00) (updated 14 December 2021)

Mongo Lock Ransom Attack

Mongo Lock is a new campaign targeting unnsecured MongoDB databases for ransom attacks

CC-2652 Medium

Published Wednesday 5 September 2018 (12:00) (updated 17 February 2020)

Malware Campaign Exploiting WMIC

A new campaign has been observed using the Windows Management Instrumentation Command-line (WMIC) tool to install a variety of different malware.

CC-2650 Medium

Published Tuesday 4 September 2018 (12:00) (updated 17 February 2020)

Apache Struts Exploit Cryptocurrency Miner

The Apache Struts vulnerability CVE-2018-11776 is being exploited by attackers in an attempt to install cryptocurrency malware .

CC-2622 Low

Published Wednesday 22 August 2018 (12:00) (updated 17 February 2020)

USBHarpoon USB-based Attack

Security researchers have created a process for producing malicious USB charging cables. Known as USBHarpoon, it adapts a previous technique for performing USB-based attacks called BadUSB.

CC-2613 Medium

Published Thursday 16 August 2018 (12:00) (updated 17 February 2020)

Office 365 Email PhishPoint Attack

PhishPoint is a new phishing attack method that is estimated to have affected up to 10% of Office 365 users worldwide at the time of publication.