Cyber alerts - NHS England Digital

Published Wednesday 8 November 2017 (12:00) (updated 11 January 2022)

Adwind Remote Access Trojan

Adwind remote access trojan (RAT), also known as jRAT, JSocket and AlienSpy, is being distributed via spam emails . The spam emails were observed to have numerous attachment titles.

CC-1792 Medium

Published Thursday 16 November 2017 (12:00) (updated 11 January 2022)

IcedID Trojan

A comprehensive banking trojan and infostealer

CC-1894 Medium

Published Monday 8 January 2018 (12:00) (updated 11 January 2022)

Necurs Botnet

Necurs is an email spam botnet responsible for delivering numerous other popular malware including Locky, Dridex, Zeus, TeslaCrypt, TrickBot and Magnitude.

CC-1940 Medium

Published Wednesday 17 January 2018 (12:00) (updated 11 January 2022)

Fake Spectre and Meltdown Patches Spread Smoke Loader Malware

A new variant of the Smoke Loader malware has been observed being distributed via fake patches for the Meltdown and Spectre vulnerabilities.

CC-1941 Low

Published Wednesday 17 January 2018 (12:00) (updated 11 January 2022)

Cloud Email Ransomware

A new unnamed ransomware has been observed that targets cloud email platforms.

CC-2139 Medium

Published Thursday 15 March 2018 (12:00) (updated 11 January 2022)

FlawedAmmyy RAT

FlawedAmmyy remote access trojan (RAT) has been created from the leaked source code for version three of Ammyy Admin remote desktop software.

CC-1154 Medium

Published Thursday 9 February 2017 (12:00) (updated 11 January 2022)

Philadelphia ransomware

Philadelphia ransomware was released for sale on the dark web marketplace, AlphaBay in late 2016.

CC-3190 Medium

Published Thursday 22 August 2019 (12:00) (updated 11 January 2022)

Bolik Banking Trojan

First observed on July 2019, Bolik is an advanced polymorphic banking trojan currently targeting English-speaking countries.

CC-3194 Low

Published Thursday 29 August 2019 (12:00) (updated 11 January 2022)

Nemty Ransomware

Nemty is a newly observed ransomware tool believed to be targeting European and CIS countries.

CC-3251 Low

Published Wednesday 9 October 2019 (12:00) (updated 11 January 2022)

FTCode Ransomware

First observed in 2013, FTCode is a PowerShell-based ransomware tool targeting users in Western Europe.