Cyber alerts

101 results

February 2020

Published Thursday 6 February 2020 (12:00) (updated 10 January 2022)

Warzone MaaS Remote Access Trojan

Warzone is a C++ based remote access trojan (RAT) offered via a number of dark web sites and hacking forums. It offers a comprehensive malware-as-a-service (MaaS) package, including licensing agreements and customer support, to allow non-technical users to perform sophisticated attacks.

January 2020

CC-3354 Low

Published Thursday 30 January 2020 (12:00) (updated 10 January 2022)

Ragnarok Ransomware

Ragnarok is a newly observed ransomware tool that exploits the Citrix ADC and Gateway remote code execution vulnerability to propagate across vulnerable networks.

CC-3346 High

Published Thursday 23 January 2020 (12:00) (updated 10 January 2022)

NotRobin Backdoor

NotRobin is a backdoor that targets Citrix/NetScaler appliances.

CC-3351 Medium

Published Thursday 23 January 2020 (12:00) (updated 29 June 2021)

BitPyLock Ransomware

BitPyLock is a ransomware tool that attempts to steal sensitive information from systems before encryption. Believed to have been created to target individual users, it has evolved to target entire networks, with operators using the extracted information to get organisations to pay ransom demands.

CC-3345 Medium

Published Thursday 16 January 2020 (12:00) (updated 29 June 2021)

Ako Ransomware

Ako, also known as MedusaReborn, is a newly observed ransomware tool targeting larger business networks. Despite being used in several active campaigns it appears to still be in active development, with its creators offering daily beta versions for attackers to use.

CC-3337 Medium

Published Thursday 16 January 2020 (12:00) (updated 29 June 2021)

PowerTrick Backdoor

First observed in late 2019, PowerTrick is a PowerShell-based backdoor believed to have been created by the group operating TrickBot for use against high-value targets.

CC-3344 Medium

Published Thursday 16 January 2020 (12:00) (updated 29 June 2021)

5ss5c Ransomware

5ss5c is newly observed ransomware that has been attributed to the same threat actor that developed Satan.

CC-3333 Medium

Published Thursday 9 January 2020 (12:00) (updated 29 June 2021)

SNAKE Ransomware

SNAKE (also known as EKANS) is a Go-based ransomware. Believed to be based on the older MegaCortex ransomware, SNAKE is also notable for affecting SCADA and industrial control systems (ICS), with evidence to suggest it is specifically targeting organisations using these products.

CC-3334 Information only

Published Thursday 9 January 2020 (12:00) (updated 29 June 2021)

Citrix Releases Security Updates

Citrix has released security updates to address vulnerabilities in Citrix products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

CC-3330 Low

Published Thursday 9 January 2020 (12:00) (updated 29 June 2021)

LiquorBot Botnet

LiquorBot is a newly observed Golang-based botnet, whose sole purpose appears to be mining Monero cryptocurrency.