Cyber alerts - NHS England Digital

Published Thursday 17 October 2019 (12:00) (updated 14 February 2020)

CrashReporter Backdoor

First observed in June 2019, CrashReporter is a backdoor believed to have been created by the Lazarus Group advanced persistent threat or based heavily on their other tools.

CC-3280 Medium

Published Thursday 31 October 2019 (12:00) (updated 14 February 2020)

Racoon Spyware

Racoon is a new malware-as-a-service (MaaS) spyware offered through a number of dark web forums.

CC-3257 Low

Published Monday 14 October 2019 (12:00) (updated 14 February 2020)

Philips Brilliance CT System Vulnerabilities

Philips Healthcare has released details of three vulnerabilities affecting a number of their Brilliance computed tomography (CT) scanners.

CC-3222 Medium

Published Thursday 19 September 2019 (12:00) (updated 14 February 2020)

Amadey Botnet

First observed in early 2019, Amadey is a botnet sold on dark web sites and hacking forums.

CC-3201 Medium

Published Thursday 5 September 2019 (12:00) (updated 14 February 2020)

Glupteba Trojan

First observed in 2018, Glupteba is a combined information stealing and downloader trojan associated with the Operation Windigo advanced persistent threat.

CC-2959 Low

Published Thursday 7 March 2019 (12:00) (updated 14 February 2020)

Docker runc Mining Campaigns

Docker hosts vulnerable to the runc Privilege Escalation Vulnerability CC-2927 discovered last month, continue to be targeted as part of ongoing campaigns aiming to compromise machines to mine for cryptocurrency.

CC-2927 Low

Published Wednesday 13 February 2019 (12:00) (updated 14 February 2020)

runc Privilege Escalation Vulnerability

Details of a privilege escalation vulnerability in the runc open-source container runtime have been disclosed by its maintainers. They claim a local threat actor could exploit this vulnerability to obtain administrative privileges within an affected container.

CC-3038 Low

Published Monday 29 April 2019 (12:00) (updated 14 February 2020)

ISC Releases BIND Security Updates

The Internet Systems Consortium (ISC) has released updates that address vulnerabilities in versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit these vulnerabilities to cause a denial-of-service condition.

CC-3002 Low

Published Friday 5 April 2019 (12:00) (updated 14 February 2020)

vxCrypter Ransomware

vxCrypter is a recently observed .NET-based ransomware tool that has the capability to delete duplicate files on infected machines.

CC-2865 Low

Published Friday 4 January 2019 (12:00) (updated 14 February 2020)

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Acrobat and Reader. An attacker could exploit these vulnerabilities to take control of an affected system.