Cyber alerts - NHS England Digital

Published Wednesday 3 June 2020 (12:00) (updated 29 June 2021)

Cisco Releases Security Updates for NX-OS Software

Cisco has released security updates to address a vulnerability in NX-OS Software. A remote attacker could exploit this vulnerability to cause a denial-of-service condition.

CC-3497 Information only

Published Thursday 11 June 2020 (12:00) (updated 29 June 2021)

VMware Releases Security Update for Horizon Client for Windows

VMware has released a security update to address a vulnerability in Horizon Client for Windows. An attacker could exploit this vulnerability to take control of an affected system.

CC-3470 Medium

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Sarwent Remote Access Trojan

First observed in 2018, Sarwent is a PowerShell-based remote access trojan sold on a number of dark web forums. Initially developed as a backdoor, it has undergone several changes to improve its capabilities.

CC-3478 Low

Published Thursday 28 May 2020 (12:00) (updated 29 June 2021)

Blue Mockingbird Cryptocurrency Campaign

Beginning in December 2019, Blue Mockingbird is a cryptocurrency mining group and campaign targeting exposed ASP.NET web servers.

CC-3453 Low

Published Thursday 14 May 2020 (12:00) (updated 29 June 2021)

Poulight Trojan

First observed in March 2020, Poulight is a .NET information-stealing trojan sold via Russian-speaking hacking forums and dark web sites.

CC-3351 Medium

Published Thursday 23 January 2020 (12:00) (updated 29 June 2021)

BitPyLock Ransomware

BitPyLock is a ransomware tool that attempts to steal sensitive information from systems before encryption. Believed to have been created to target individual users, it has evolved to target entire networks, with operators using the extracted information to get organisations to pay ransom demands.

CC-3394 Information only

Published Monday 16 March 2020 (12:00) (updated 29 June 2021)

VMware Releases Security Update

VMware has released security updates to address multiple vulnerabilities in Fusion, Horizon, Remote Console, and Workstation products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

CC-3396 Low

Published Thursday 19 March 2020 (12:00) (updated 29 June 2021)

NEFILIM Ransomware

NEFILIM is a newly observed ransomware tool that appears to be a fork of the well-known Nemty 2.5 ransomware-as-a-service. However, unlike Nemty, NEFILIM appears to use basic email communications for affiliate payments.

CC-3443 Information only

Published Thursday 30 April 2020 (12:00) (updated 29 June 2021)

VMware Releases Security Updates for ESXi

VMware has released security updates to address a vulnerability in ESXi. An attacker could exploit this vulnerability to take control of an affected system.

CC-3376 Medium

Published Thursday 20 February 2020 (12:00) (updated 29 June 2021)

Sweyntooth Bluetooth Module Vulnerabilities

Sweyntooth is a collection of vulnerabilities that are known to affect several Bluetooth Low Energy (BLE) modules from different manufacturers. A large number of Internet-of-Things (IoT) products are affected by the vulnerabilities to varying degrees, including some medical devices.