Cyber alerts

101 results

June 2020

CC-3486 Medium

Published Thursday 4 June 2020 (12:00) (updated 29 June 2021)

ShellReset Remote Access Trojan

ShellReset is a newly observed .NET remote access trojan believed to be based on the older Quasar malware.

CC-3483 Medium

Published Wednesday 3 June 2020 (12:00) (updated 29 June 2021)

Valak Trojan

Valak is a sophisticated modular trojan used in targeted attacks against financial and government organisations throughout Western Europe and North America. Initially used solely as a loader in IcedID and Ursnif campaigns, it appears to have undergone significant changes to improve functionality.

May 2020

CC-3474 Medium

Published Thursday 28 May 2020 (12:00) (updated 26 February 2021)

ComRAT Trojan

ComRAT is a trojan created by the Turla advanced persistent threat group for use in attacks against American and European government organisations.

CC-3472 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Thanos Ransomware-as-a-Service

Thanos is a C# based ransomware tool and builder created by the Nosophoros advanced persistent threat for sale through an affiliate program. Whilst sometimes referred to as Hakbit, this name describes a number of ransomware variants understood to have been created using the Thanos builder.

CC-3470 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Sarwent Remote Access Trojan

First observed in 2018, Sarwent is a PowerShell-based remote access trojan sold on a number of dark web forums. Initially developed as a backdoor, it has undergone several changes to improve its capabilities.

CC-3474 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

ComRAT Trojan

ComRAT is a trojan created by the Turla advanced persistent threat group for use in attacks against American and European government organisations. Believed to have been created around 2007, it appeared to have fallen out of use by Turla, until 2017 when several functionality changes were made.

CC-3480 Low

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

[F]Unicorn Ransomware

[F]Unicorn is a newly observed ransomware tool targeting users throughout Western Europe.

CC-3471 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Silent Night Trojan

Silent Night (also known as SILENT NIGHT or SilentNight Zbot) is a newly observed trojan and botnet family based on the Zloader malware. It is currently offered as-a-service through a number of primarily Russian-speaking dark web forums.

CC-3473 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Ketrum Backdoor

Ketrum is a newly observed backdoor developed by the Ke3chang advanced persistent threat group for use in their own campaigns. Believed to be created from two of the older tools, Ketrican and Okrum, it has been used attacks against European government organisations.

CC-3469 Medium

Published Thursday 21 May 2020 (12:00) (updated 29 June 2021)

QNodeService Trojan

First observed in May 2020, QNodeService is a modular Node.js based information-stealing trojan delivered in a number of Covid-19 related campaigns.