Cyber alerts

101 results

March 2020

Published Thursday 19 March 2020 (12:00) (updated 29 June 2021)

NEFILIM Ransomware

NEFILIM is a newly observed ransomware tool that appears to be a fork of the well-known Nemty 2.5 ransomware-as-a-service. However, unlike Nemty, NEFILIM appears to use basic email communications for affiliate payments.

CC-3389 Low

Published Tuesday 10 March 2020 (12:00) (updated 29 June 2021)

Tuyul IRC Botnet

First observed in January 2020, Tuyul is a Perl-based Internet Relay Chat (IRC) botnet targeting a known vulnerability in the PHPUnit testing framework.

CC-3385 Low

Published Monday 9 March 2020 (12:00) (updated 29 June 2021)

ProLocker Ransomware

ProLocker is ransomware first observed in late 2019 that has targeted local government authorities. Previously known as PwndLocker, it was renamed after its creators altered it to prevent free decryption of affected files.

February 2020

CC-3380 Low

Published Thursday 27 February 2020 (12:00) (updated 29 June 2021)

Nuke Ransomware

First observed in 2016, Nuke is a ransomware tool targeting organisations globally.

CC-3382 Medium

Published Thursday 27 February 2020 (12:00) (updated 29 June 2021)

Mozart Backdoor

Mozart is a backdoor that targets Microsoft Windows and uses the DNS protocol for command and control (C2) communication.

CC-3374 Medium

Published Thursday 20 February 2020 (12:00) (updated 29 June 2021)

Hidden Cobra Trojans

A number of new downloader and remote access trojans (RAT) have been observed in campaigns globally. All five identified tools are believed to have been created by the Hidden Cobra advanced persistent threat group for use in their own campaigns.

CC-3373 Medium

Published Thursday 20 February 2020 (12:00) (updated 29 June 2021)

Parallax Remote Access Trojan

First observed in December 2019, Parallax is an MASM-based remote access trojan sold through a number of hacking forums, with its creators offering a number of additional support services as well as bespoke development based on affiliate feedback.

CC-3363 Medium

Published Thursday 13 February 2020 (12:00) (updated 29 June 2021)

KBOT Virus

First observed in early 2020, KBOT is a polymorphic virus that exfiltrates financial and credential data from affected systems. As of the time of publication, it appears to be the first new virus observed in the wild in several years.

CC-3362 Medium

Published Thursday 13 February 2020 (12:00) (updated 10 January 2022)

Ragnar Locker Ransomware

Ragnar Locker is a newly observed ransomware tool targeting organisations in North America, Europe, and East Asia.

CC-3360 Medium

Published Thursday 6 February 2020 (12:00) (updated 29 June 2021)

Netwalker Ransomware

Netwalker (also known as Kazakavkovkiz or KoKo) is a fileless ransomware-as-a-service tool, mainly targeted at enterprise targets in Western Europe and the USA. Previously called Mailto, the name was changed when the creators began offering its services to affiliate users via dark web sites.