Cyber alerts - NHS England Digital

Published Thursday 17 October 2019 (12:00) (updated 11 January 2022)

SDBot Remote Access Trojan

SDBot is a newly observed C++ based remote access trojan created by the TA505 advanced persistent threat group for use in their campaigns.

CC-3293 Medium

Published Wednesday 20 November 2019 (12:00) (updated 11 January 2022)

ACBackdoor Backdoor

First observed in early September 2019, ACBackdoor is a multi-platform backdoor targeting Windows and Linux systems.

CC-1069 Low

Published Thursday 12 January 2017 (12:00) (updated 11 January 2022)

FireCrypt - The Ransomware with DDoS Component

A new ransomware-as-a-service, called BleedGreen, allows users to run and perform the FireCrypt ransomware which also attempts a DDoS attack.

CC-1044 Medium

Published Thursday 5 January 2017 (12:00) (updated 11 January 2022)

Troldesh Ransomware

An occurrence of Troldesh ramsomware has affected a California Health Centre in the USA. It encrypted 65,000 patient files stored on a server.

CC-1087 Medium

Published Thursday 19 January 2017 (12:00) (updated 11 January 2022)

Spora Ransomware

Spora is a new ransomware with the ability to work offline without the need to communicate with a C2 server and specifically targets business users.

CC-1483 Medium

Published Wednesday 21 June 2017 (12:00) (updated 11 January 2022)

Erebus Ransomware targeting Linux Servers

Erebus was first spotted in a spate of malvertising attacks in September 2016 and then reappeared in 2017 using a method to bypass Windows' User Account Control.

CC-2312 Medium

Published Thursday 26 April 2018 (12:00) (updated 11 January 2022)

PyRoMine Cryptocurrency Miner

A newly observed Python-based cryptocurrency miner, known as PyRoMine, has been seen using the EternalRomance SMB exploit to propagate.

CC-2321 Medium

Published Wednesday 2 May 2018 (12:00) (updated 11 January 2022)

Rubella Macro Builder Malware Kit

A new malware builder and loader has been observed distributing the Panda and Gootkit financial trojans.

CC-2422 Medium

Published Thursday 24 May 2018 (12:00) (updated 11 January 2022)

GDPR-related Phishing Advisory

Several General Data Protection Regulation (GDPR) related phishing and spam campaigns have been observed attempting to exploit the mass communications organisations are sending to their users to ensure compliance with the new regulation.

CC-2505 Medium

Published Thursday 21 June 2018 (12:00) (updated 11 January 2022)

Mylobot Botnet

Mylobot is a botnet that targets and takes control of devices running Microsoft Windows.