Cyber alerts

101 results

May 2020

Published Thursday 21 May 2020 (12:00) (updated 29 June 2021)

Mandrake Android Spyware

First observed in early 2020, Mandrake is a sophisticated spyware platform and associated support infrastructure used for targeted attacks against finance and commercial organisations in Europe and the USA.

CC-3466 Medium

Published Thursday 21 May 2020 (12:00) (updated 10 January 2022)

RATicate Malware Campaign

An advanced persistent threat group, RATicate, has been delivering well-known remote access trojans and information stealers in several campaigns. The group appear to primarily target industrial, telecommunications, and manufacturing organisations in the UK, Europe, East Asia, and the Middle East.

CC-3453 Low

Published Thursday 14 May 2020 (12:00) (updated 29 June 2021)

Poulight Trojan

First observed in March 2020, Poulight is a .NET information-stealing trojan sold via Russian-speaking hacking forums and dark web sites.

CC-3452 Medium

Published Thursday 14 May 2020 (12:00) (updated 29 June 2021)

Ramsay Trojan

Ramsay is a highly sophisticated information-stealing trojan and associated espionage framework capable of operating on air-gapped systems. First observed in September 2019, it is believed to have been created by or for the Darkhotel advanced persistent threat group.

CC-3451 Medium

Published Thursday 14 May 2020 (12:00) (updated 29 June 2021)

Dark Crystal Remote Access Trojan

First observed in early 2020, Dark Crystal (also known as DCRat) is an advanced C# and .NET based remote access trojan.

CC-3454 Medium

Published Thursday 14 May 2020 (12:00) (updated 29 June 2021)

Hidden Cobra Trojans: COPPERHEDGE, PEBBLEDASH, and TAINTEDSCRIBE

Three new trojans believed to have been created the Hidden Cobra advanced persistent threat group have been observed.

CC-3449 Low

Published Wednesday 6 May 2020 (12:00) (updated 29 June 2021)

Kaiji IoT Botnet

Kaiji is a Go-based worm and botnet associated with an ongoing campaign targeting exposed Linux servers and Internet-of-Things (IoT) devices. Unusually for IoT malware, Kaiji appears to be entirely bespoke and does not contain any code from more well-known botnets such as Mirai.

CC-3450 Low

Published Wednesday 6 May 2020 (12:00) (updated 29 June 2021)

VCrypt Ransomware

VCrypt is a newly observed ransomware tool targeting Western Europe. Unlike most ransomware, VCrypt does not encrypt files.

April 2020

CC-3437 Medium

Published Thursday 30 April 2020 (12:00) (updated 18 January 2022)

Asnarök Trojan

Asnarök is a newly observed trojan targeting Sophos firewall systems affected by the recently disclosed vulnerability CVE-2020-12271.

CC-3438 Medium

Published Thursday 30 April 2020 (12:00) (updated 10 January 2022)

Syndet Backdoor

First observed in late April, Syndet (also known as BazarBackdoor and BeerBot) is a sophisticated backdoor believed to have been created by Trickbot's authors for use in their own campaigns.