Cyber alerts - NHS England Digital

CC-3844 Medium

Published Wednesday 5 May 2021 (04:33) (updated 10 January 2022)

FIVEHANDS Ransomware

A ransomware tool dropped by SOMBRAT malware

CC-3326 Low

Published Thursday 2 January 2020 (12:00) (updated 10 January 2022)

Mozi Botnet

Mozi is a newly observed worm and botnet believed to based on a version of the BASHLITE malware.

CC-3346 High

Published Thursday 23 January 2020 (12:00) (updated 10 January 2022)

NotRobin Backdoor

NotRobin is a backdoor that targets Citrix/NetScaler appliances.

CC-3354 Low

Published Thursday 30 January 2020 (12:00) (updated 10 January 2022)

Ragnarok Ransomware

Ragnarok is a newly observed ransomware tool that exploits the Citrix ADC and Gateway remote code execution vulnerability to propagate across vulnerable networks.

CC-3361 Medium

Published Thursday 6 February 2020 (12:00) (updated 10 January 2022)

Warzone MaaS Remote Access Trojan

Warzone is a C++ based remote access trojan (RAT) offered via a number of dark web sites and hacking forums. It offers a comprehensive malware-as-a-service (MaaS) package, including licensing agreements and customer support, to allow non-technical users to perform sophisticated attacks.

CC-3362 Medium

Published Thursday 13 February 2020 (12:00) (updated 10 January 2022)

Ragnar Locker Ransomware

Ragnar Locker is a newly observed ransomware tool targeting organisations in North America, Europe, and East Asia.

CC-3399 Low

Published Thursday 19 March 2020 (12:00) (updated 10 January 2022)

CoronaVirus Ransomware

First observed February 2020, CoronaVirus is a ransomware tool. Despite it's name, it appears to have little relation to the COVID-19 pandemic

CC-3401 Medium

Published Thursday 19 March 2020 (12:00) (updated 10 January 2022)

GuLoader Downloader

First observed in December 2019, GuLoader is a VB6-based downloader trojan. Despite its age, it has swiftly become popular with threat groups and has been observed in campaigns delivering a number of well-known malware.

CC-3410 Information only

Published Wednesday 25 March 2020 (12:00) (updated 10 January 2022)

HPE Releases Update for Enterprise SSD

HPE has released a firmware update to address an abnormal drive failure issue in a number of their server and storage (SAS) solid-state drive (SSD) products. Affected products will fail after 40,000 total operational hours, resulting in total data loss.

CC-3438 Medium

Published Thursday 30 April 2020 (12:00) (updated 10 January 2022)

Syndet Backdoor

First observed in late April, Syndet (also known as BazarBackdoor and BeerBot) is a sophisticated backdoor believed to have been created by Trickbot's authors for use in their own campaigns.