Cyber alerts - NHS England Digital

Published Tuesday 6 August 2019 (12:00) (updated 11 January 2022)

SystemBC Proxy Malware

Popular dark-web proxy tool

Published Wednesday 7 August 2019 (12:00) (updated 11 January 2022)

Lord Exploit Kit

First observed in early 2019, Lord is an exploit kit associated with the older Spelevo kit. Whilst its authors claim it is still in active development, Lord appears to be for sale via dark web forums and has been used in several campaigns.

CC-3175 Low

Published Monday 12 August 2019 (12:00) (updated 11 January 2022)

Emptiness DDoS Botnet

Emptiness is a newly observed Golang-based worm based on Mirai.

CC-3177 Medium

Published Thursday 15 August 2019 (12:00) (updated 11 January 2022)

VBShower Backdoor

VBShower is a newly observed PowerShell-based polymorphic backdoor, created by the Inception advanced persistent threat group to replace their older PowerShower malware.

CC-1860 Medium

Published Thursday 14 December 2017 (12:00) (updated 11 January 2022)

Napoleon Ransomware

An altered version of the Blind ransomware, known as Napoleon, has been observed using a manual attack vector to compromise systems. Unlike Blind, which targeted user-generated files only, Napoleon will encrypt all available local and remote files.

CC-1858 Medium

Published Thursday 14 December 2017 (12:00) (updated 11 January 2022)

StorageCrypt Ransomware

StorageCrypt is a new family of ransomware that targets network-attached storage (NAS) devices using SambaCry ( CVE-2017-7494 ). SambaCry allows remote attackers to execute arbitrary code on targeted systems by uploading a shared library to a writable network share, and then causing the server to load that library.

CC-1673 Medium

Published Friday 29 September 2017 (12:00) (updated 11 January 2022)

RedBoot - Ransomware that Encrypts the Hard Drive Permanently

A newly discovered ransomware has been found to encrypt files but also alters the partition table and Master Boot Record (MBR) with the aim to cause permanent damage.

CC-1820 Low

Published Tuesday 28 November 2017 (12:00) (updated 11 January 2022)

qkG Filecoder Ransomware Discovered

A new proof-of-concept ransomware called qkG Filecoder (also known as RANSOM_CRYPTOQKG.A), with minor similarities to the Lukitus Locky variant, has been observed being tested using an unusual macro technique.

CC-1829 Medium

Published Thursday 30 November 2017 (12:00) (updated 11 January 2022)

Scarab Ransomware

Scarab is based on a proof-of-concept ransomware called HiddenTear and is marked as being less sophisticated than more popular variants like Locky. It is delivered via phishing emails using a .7z attachment containing a VBScript dropper.

CC-1724 Medium

Published Wednesday 25 October 2017 (12:00) (updated 11 January 2022)

BadRabbit Ransomware

A new variant of the Petya ransomware has been discovered.