Cyber alerts

44 results

November 2017

Published Thursday 30 November 2017 (12:00) (updated 4 November 2020)

Analysis of Turla's Neuron and Nautilus Tools

An analysis of two tools, Neuron and Nautilus, used by the Turla advanced persistent threat (APT) group has been released.

CC-1825 Medium

Published Thursday 30 November 2017 (12:00) (updated 17 February 2020)

Andromeda Modular Botnet

Andromeda (also known as Gamarue) is an HTTP-based modular botnet with anti-detection and anti-analysis capabilities. Activity has been based primarily around the US, Japan and Turkey.

CC-1824 Low

Published Thursday 30 November 2017 (12:00) (updated 17 February 2020)

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in its WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files.

CC-1829 Medium

Published Thursday 30 November 2017 (12:00) (updated 11 January 2022)

Scarab Ransomware

Scarab is based on a proof-of-concept ransomware called HiddenTear and is marked as being less sophisticated than more popular variants like Locky. It is delivered via phishing emails using a .7z attachment containing a VBScript dropper.

CC-1822 Medium

Published Wednesday 29 November 2017 (12:00) (updated 17 February 2020)

High Sierra Root Access Vulnerability

A trivial-to-exploit vulnerability in Apple’s macOS 10.13 (aka High Sierra) allows any user to gain administration privileges.

CC-1820 Low

Published Tuesday 28 November 2017 (12:00) (updated 11 January 2022)

qkG Filecoder Ransomware Discovered

A new proof-of-concept ransomware called qkG Filecoder (also known as RANSOM_CRYPTOQKG.A), with minor similarities to the Lukitus Locky variant, has been observed being tested using an unusual macro technique.

CC-1810 Medium

Published Friday 24 November 2017 (12:00) (updated 17 February 2020)

F5 Networks BIG-IP Vulnerability

F5 Networks BIG-IP virtual server appliances may be vulnerable to an Adaptive Chosen-Ciphertext attack (ACC, also known as a Bleichenbacher attack) when configured with a Client SSL profile.

CC-1805 Low

Published Thursday 23 November 2017 (12:00) (updated 17 February 2020)

Cisco FindIT Discovery Utility Insecure Library Loading Vulnerability

Cisco has released details of a vulnerability affecting their FindIT network discovery tool that may allow an authenticated local user to perform a dynamic-link library (DLL) pre-loading attack.

CC-1809 Low

Published Thursday 23 November 2017 (12:00) (updated 17 February 2020)

Fake Anti-Virus Pages Used in Phishing Attack

A new type of phishing attack deception technique has been observed where malicious actors style webpages to present themselves as an anti-virus company.

CC-1808 Low

Published Thursday 23 November 2017 (12:00) (updated 17 February 2020)

Office OLE Vulnerability Allows Remote Code Execution

A memory corruption fault in the EQNEDT32.exe Object Linking and Embedding (OLE) used by Microsoft Office products for insertion of equations may result in an unauthenticated, remote user being able to execute arbitrary code.