Cyber alerts

171 results

December 2019

Published Thursday 19 December 2019 (12:00) (updated 29 June 2021)

Manager APT Toolkit

First observed in late 2019, the Manager toolkit is a set of three C++ based tools; NewManager, AmpManager, and DDoSManager, created by the ChinaZ advanced persistent threat to primarily target Linux web servers.

CC-3320 Medium

Published Thursday 19 December 2019 (12:00) (updated 29 June 2021)

Dacls Remote Access Trojan

First observed in October 2019, Dacls is a multi-platform modular remote access trojan believed to have been created by the Hidden Cobra advanced persistent threat group.

CC-3317 Low

Published Wednesday 18 December 2019 (12:00) (updated 29 June 2021)

Momentum Botnet

First observed in late 2018, Momentum is a worm and botnet targeting Linux-based web servers, Internet-of-Things and SOHO devices. The group operating Momentum are believed to be selling the botnet's services through a number of dark web forums.

CC-3314 Medium

Published Thursday 12 December 2019 (12:00) (updated 29 June 2021)

Zeppelin Ransomware

Zeppelin is an advanced ransomware-as-a-service tool based on the VegaLocker and Buran malware. Despite sharing large amounts of its code with these older tools, Zeppelin appears to be explicitly targeted at healthcare and technology organisations throughout Western Europe and the USA.

CC-3308 Medium

Published Thursday 12 December 2019 (12:00) (updated 29 June 2021)

Snatch Ransomware

Snatch is a newly observed ransomware-as-a-service tool primarily targeting American, Canadian, and European organisations.

CC-3303 Medium

Published Thursday 5 December 2019 (12:00) (updated 29 June 2021)

PyXie Remote Access Trojan

PyXie is a newly observed Python-based remote access trojan that is used in highly targeted campaigns against financial, engineering, and government organisations.

CC-3305 Low

Published Thursday 5 December 2019 (12:00) (updated 29 June 2021)

CStealer Trojan

CStealer is a newly observed information-stealing trojan targeting the Google Chrome web browser.

CC-3302 Medium

Published Wednesday 4 December 2019 (12:00) (updated 29 June 2021)

Machete Trojan

First observed in early 2019, Machete (also known as Ragua) is a Python-based information stealing trojan. Originally targeted at Spanish-speaking Latin American countries, it has begun to appear in campaigns in Europe and North America.

November 2019

CC-3299 Low

Published Thursday 28 November 2019 (12:00) (updated 14 February 2020)

Dexphot Trojan

First observed in October 2018, Dexphot is a polymorphic trojan sold on hacking forums and dark web sites.

CC-3298 Medium

Published Thursday 28 November 2019 (12:00) (updated 14 February 2020)

DePriMon Downloader Trojan

First observed in March 2017, DePriMon (Default Print Monitor) is an advanced fileless downloader believed to be associated with the Lamberts (also known as ColoredLamberts or Longhorn) advanced persistent threat group.