Cyber alerts

53 results

September 2018

Published Friday 28 September 2018 (12:00) (updated 17 February 2020)

DNSSEC Key Signing Key Rollover

On October 11, 2018, the Internet Corporation for Assigned Names and Numbers (ICANN) will be changing the Root Zone Key Signing Key (KSK) used in the Domain Name System Security Extensions (DNSSEC) protocol.

CC-2694 Low

Published Thursday 27 September 2018 (12:00) (updated 17 February 2020)

SpicyOmelette Remote Access Trojan

SpicyOmelette is a remote access trojan that has been observed as a component of cyber attacks initiated by the Cobalt Advanced Persistent Threat (APT) group.

CC-2688 Low

Published Thursday 27 September 2018 (12:00) (updated 6 September 2021)

Linux Mutagen Astronomy Vulnerability

A vulnerability in the Linux operating system kernel called Mutagen Astronomy has been disclosed that could allow an attacker to obtain local escalated privileges.

CC-2693 Medium

Published Thursday 27 September 2018 (12:00) (updated 17 February 2020)

MadoMiner Cryptocurrency Worm

MadoMiner is a newly observed cryptocurrency mining worm that uses large portions of the ZombieBoy remote access trojan's code.

CC-2692 Low

Published Thursday 27 September 2018 (12:00) (updated 17 February 2020)

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.

CC-2625 Medium

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

WordPress Tech Support Redirection Campaigns

New campaigns have been observed targeting outdated WordPress installations and related plugins to enrol affected users in technical support scams or redirect them to malicious sites.

CC-2686 Low

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

Microsoft JET Database Engine RCE Vulnerability

A vulnerability has been disclosed in the Microsoft JET Database Engine that could allow remote code execution by an attacker.

CC-2685 Low

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

New Delphi-based Packer Used to Avoid AV Detection

A new executable packer has been observed being used by several well-known malware variants, including LokiBot, Remcos and AZORult, to avoid classification or detection by anti-virus and other security solutions.

CC-2689 Low

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

Ngrok Mining Botnet

Ngrok is a newly observed campaign that is targeting exposed servers to enrol them into a cryptocurrency mining botnet.

CC-2690 Medium

Published Wednesday 26 September 2018 (12:00) (updated 17 February 2020)

DanaBot Banking Trojan

First observed in May 2018, DanaBot is a Delphi-based modular banking trojan . It was initially seen targeting Australian organisations, but has now begun appearing through Western Europe.