Cyber alerts - NHS England Digital

Published Thursday 19 April 2018 (12:00) (updated 17 February 2020)

WebMonitor Remote Access Trojan

First observed in February 2017, WebMonitor is a remote access trojan (RAT) with added virtual private network (VPN) and command and control (C2) capabilities.

CC-2286 Medium

Published Thursday 19 April 2018 (12:00) (updated 17 February 2020)

XIAOBA File Corruptor and Miner

XIAOBA is a sophisticated file corruptor and cryptocurrency miner .

CC-2607 Low

Published Tuesday 4 September 2018 (12:00) (updated 17 February 2020)

CryptoNar Ransomware

CryptoNar is a new variant of the CryptoJoker ransomware that uses different encryption processes for different file types.

CC-2362 Low

Published Thursday 10 May 2018 (12:00) (updated 17 February 2020)

Domain Shadowing Using Fake Flash Updates

A new domain shadowing campaign has been observed using fake Adobe Flash updates to redirect affected users to malicious sites.

CC-2403 Low

Published Thursday 17 May 2018 (12:00) (updated 17 February 2020)

Cisco Releases Security Updates

Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

CC-1968 Low

Published Thursday 25 January 2018 (12:00) (updated 17 February 2020)

Apple chaiOS DoS Vulnerability

A vulnerability has been discovered in Apple's iOS and macOS operating systems that can cause a device to freeze or restart.

CC-2532 Low

Published Tuesday 10 July 2018 (12:00) (updated 17 February 2020)

Apple Releases Multiple Security Updates

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.

CC-2618 Medium

Published Monday 20 August 2018 (12:00) (updated 17 February 2020)

Marap Downloader

Marap is a newly discovered C-based downloader malware being used in large-scale campaigns by the TA505 advanced persistent threat group.

CC-2498 Medium

Published Thursday 21 June 2018 (12:00) (updated 17 February 2020)

Microsoft WIM Remote Code Execution Vulnerability

A vulnerability in Microsoft's library file 'wimgapi.dll' which is used with Windows Imaging Format (WIM) files has been discovered that could allow remote code execution.

CC-2856 Medium

Published Thursday 20 December 2018 (12:00) (updated 17 February 2020)

TripleM Ransomware

TripleM is a ransomware tool first seen in August 2017. The source code has been made available for sale since December 2018.