Hot topics 2021

04.01.2022 - In the last weekly review of 2021, the NCSC looks back at the 21,000 reports received over the last 12 months. We would like to take this opportunity to thank you for all your reports. They help us to better assess the situation in cyberspace and warn potential new victims more effectively.

28.12.2021 - Last week, the NCSC again received a significant number of reports. Some of the most frequent reports to the NCSC this year concerned bogus parcel notifications. Malware was likewise distributed using this method last week. For the first time, the NCSC also received a report about a scam on a carpooling portal.

21.12.2021 - Last week, the NCSC again received a significant number of reports. The number of dodgy online shops is on the rise in the run-up to Christmas. In addition, emails that use old email exchanges known to the recipient are once again being sent, with the aim of spreading malware.

17.12.2021 - A new way of exploiting the Log4j security vulnerability allows attackers to execute arbitrary code remotely (remote code execution, or RCE). The security vulnerability is already being actively exploited by cybercriminals. The NCSC urgently recommends applying the security patches as soon as possible.

14.12.2021 - The NCSC once again received a higher number of reports in the second week of December. One case of advance payment fraud reported to the NCSC is a perfect example of the lengths fraudsters go to in order to achieve their goal with a person who appears willing to pay. Fake extortion is another frequently reported scam at present. In some cases, fedpol is indicated as the sender.

13.12.2021 - At the end of last week, a zero-day vulnerability in the popular Java library Log4j was disclosed. The security vulnerability is classified as critical, as the library is used in a great many Java applications. Moreover, the security vulnerability allows an attacker to execute arbitrary code remotely (remote code execution, or RCE). It is already being actively exploited by cybercriminals to infect vulnerable systems with malware. The NCSC recommends applying the security patches as quickly as possible.

09.12.2021 - The National Cybersecurity Centre (NCSC) website, together with the Swiss Security Network (SSN), now also offers dedicated information for authorities.

07.12.2021 - The number of reports received by the NCSC increased once again last week. Christmas is a time of abundant fraud attempts. Two of the cases reported this week were aimed at extracting additional money from victims as part of an ongoing investment fraud.

30.11.2021 - Today, on Computer Security Day, the NCSC looks back on another week that saw an increase in the number of reports received. The familiar fake support scam is now being perpetrated in cases of investment fraud. The well-known phishing attempts made in the name of Swiss Post are also appearing in a new guise. The scammers pretend to be a chatbot from the postal service.

29.11.2021 - In recent days, several countries have reported the return of Emotet. Now, such spam emails from .ch senders have also been observed. Emotet is often hidden in Microsoft Office files and requires macros to install the malware on the IT system, e.g. a computer. These attacks can affect private users, as well as companies, authorities and critical infrastructures. The NCSC recommends being extremely cautious, especially in the case of emails with attached files.

24.11.2021 - On the last Friday of November, numerous retailers tempt customers with amazing offers – also online. But be careful; not all offers deliver what they promise. Cybercriminals may also be lurking behind some of these offers.

23.11.2021 - On 23 November 2021, the Working Party on Security in the Digital Economy of the Organisation for Economic Co-operation and Development (OECD) appointed Florian Schütz, the Federal Cybersecurity Delegate, as its new Chair. Mr Schütz will formally start in this position as of 1 January 2022.

23.11.2021 - Der Meldeeingang beim NCSC bleibt erhöht. Dem NCSC wurde ein Entwicklungsserver gemeldet, welche für das Schürfen von Kryptogeld missbraucht wurde. Beim Angriff auf das Touristikunternehmen FTI-Group sind auch Daten von Schweizer Bürgern in die Hände von Hackern gefallen. Zudem hat das NCSC der am letzten Montag veröffentlichten «Blacksmith» Schwachstelle die international gültige «Common Vulnerabilities and Exposure»-Identifikationsnummer vergeben.

18.11.2021 - The expansion and promotion of cyberskills is a key goal of the national strategy for the protection of Switzerland against cyber-risks (NCS). As part of the NCS implementation, the Swiss Security Network (SSN), together with armasuisse's Cyber-Defence Campus and the Military Academy (MILAC) at ETH Zurich, has drawn up a list of the best training courses on cyber-issues. Published today, it shows that there is already a wide range of courses available on the subject.

16.11.2021 - The number of reports received by the NCSC increased last week. Attacks on Microsoft Exchange Servers continue to be reported. In addition, the NCSC received reports of various variants of advance fee fraud that differ from the usual modus operandi. A type of fraud was also reported in which the Facebook Mentions function is misused to carry out targeted phishing attacks.

15.11.2021 - The NCSC has examined an IT vulnerability reported to it by ETH Zurich and, as an authorised Numbering Authority, has issued an identifier for the first time. The vulnerability known as Blacksmith, discovered by researchers at ETH Zurich, Qualcomm and Vrije Universiteit Amsterdam, has now been published.

11.11.2021 - If you recognise the sender's email address that is displayed, you can by no means assume that the email actually came from that person. Sender email addresses can actually be forged with ease.

09.11.2021 - The number of reports received by the NCSC was moderate last week. Aside from numerous phishing emails, there were numerous Microsoft Exchange Server attacks. Malware emails were sent via the hacked servers. Moreover, a new type of scam showed how people end up on a dubious website after a quote request for a subsea bolt tensioner.

02.11.2021 - The NCSC's second semi-annual report deals with the most important cyberincidents of the first half of 2021 in Switzerland and internationally. The main topic is dedicated to vulnerabilities in IT systems that can be exploited to carry out cyberattacks.

01.11.2021 - The number of reports received by the NCSC has fallen back to a moderate level. Fraudulent calls from supposed employees of mobile phone providers are becoming more common and various formats have emerged in recent weeks. An alleged donation to a charitable organisation by an ostensible Swiss multimillionaire was also a topic for the NCSC.

26.10.2021 - The number of reports received by the NCSC remains high. The reason is the persistence of text messages with an alleged voicemail linked to Android malware. Reports were also received about malicious Excel documents that were apparently sent by someone known to the victim and referred to a previous message. Other reports concerned a targeted request to a law firm which culminated in attempted fraud, and an instance of advance fee fraud combined with phishing.

19.10.2021 -The number of reports was very high last week. This was due, among other things, to a spate of spam advertising bitcoin investments and over a hundred reports of text messages with an alleged voicemail that led to Android malware. Another topic for the NCSC last week was a new scam involving online review systems.

12.10.2021 - Last week, the number of reports received remained moderate. The data leak from a hacked video streaming portal showed once again how quickly sensitive data can be made freely accessible on the internet. The second case is an example of how easy it is for fraudsters to obtain money using payment services.

05.10.2021 - With the start of the autumn holidays, the NCSC received fewer reports last week. It has observed that fake support call fraudsters have been trying to reach their victims in other ways recently. Ill-gotten money has to be laundered at some stage. The second case describes how people are sought for this.

30.09.2021 - During its meeting on 17 August 2021, the Federal Council's Cybercommittee adopted the report on the progress made in implementing the 2018-2022 national strategy for the protection of Switzerland against cyber-risks (NCS). Implementation is proceeding according to plan and is supported by the cantons, the business community and universities. The report was published today.

28.09.2021 - Starting today, the National Cybersecurity Centre (NCSC) is part of the global network for the management of IT system vulnerabilities. This means that the NCSC, as a specialist body, is now permitted to assign a unique identification number to reported vulnerabilities in accordance with the international reference system. The NCSC has been authorised to do so by the competent independent US organisation, MITRE.

27.09.2021 - The NCSC once again received an increased number of reports last week. Fraudulent competitions that claimed to mark the Coop's 50 anniversary were noteworthy. With classified ad scams where the victim is supposed to pay despite selling an item, the fraudsters go to considerable lengths to persuade the victims to hand over their credit card details.

21.09.2021 - The NCSC received an increased number of reports last week. Several variants of supposed threats on behalf of the police, among others, stood out. The emails threaten to initiate criminal proceedings against the recipient if no reply is received within 72 hours. Once again, a website promises victims of investment fraud that it will recover their lost money.

14.09.2021 - Last week, in addition to the reports it received (which were within the normal range), the NCSC's focus was on a new development. With immediate effect, the NCSC's weekly statistics on the number and type of reports are available in interactive form, thereby simplifying data queries. Among the reports, the NCSC noted another report about a fictitious hotel website, which was ostensibly looking for new staff but then demanded a "fee".

07.09.2021 - The NCSC registered an average number of reports last week. It dealt with reports about the resurrection of websites that were thought to have been deleted. There were also renewed reports of a familiar blackmail technique involving deleted databases.

31.08.2021 - The number of reports received by the NCSC increased again last week. There are still many reports concerning fake PostFinance pages opened via Google ads. The procedure is reminiscent of fake support calls. In addition, the victims of CEO fraud are being contacted not only via email, but also by phone. And it has become apparent that it is sometimes difficult for employees to recognise phishing emails with Office 365.

24.08.2021 - The NCSC received a moderate number of reports last week. Fraudsters attempted to lure visitors into making large "investments" with a supposed "promotion" for the cryptocurrency Cardano. Reports of ransomware incidents rose slightly again, with five reports. In addition, the NCSC received several reports about Instagram and Telegram accounts offering vaccination passports and COVID-19 certificates.

18.08.2021 - The NCSC has observed several successful cyberattacks on Swiss companies in recent months. In these attacks, cybercriminals encrypted corporate networks using an encryption Trojan (so-called "ransomware") and successfully demanded a ransom.

17.08.2021 - The NCSC received few reports last week. Fraudsters used a fake Google ad to try to lure bank customers to a bogus site. In another case, considerable effort was made to hack a Facebook account. In addition, an increasing number of attempted attacks on Synology network storage devices were reported in Switzerland and around the world. Users are strongly advised to use strong passwords

10.08.2021 - The NCSC once again received an average number of reports last week. A report on a cloned website revealed a new modus operandi in which the customer behaviour of Swiss companies is analysed. Moreover, further attempts were made to convince victims to install malware by phoning about alleged parcel deliveries. To do this, the attackers pretended to be from Swiss Post and did not use fictitious company names like in the past.

09.08.2021 - During a conference last week, security researchers presented new vulnerabilities in Microsoft Exchange Server. Hackers are now trying to detect vulnerable systems by means of scanning in order to attack them. The NCSC recommends immediately applying the patches provided by Microsoft.

03.08.2021 - The number of reports received by the NCSC remained moderate last week. Fake reviews on well-known review sites give victims of investment scams tips and contact details for getting their money back. If victims act on these tips, they are scammed a second time. In addition, fraudsters have been trying to take over other people's WhatsApp accounts by means of voicemail hacking.

27.07.2021 - The NCSC received few reports last week. DDoS attacks by the Fancy Lazarus group continue to be reported. However, the second attack that had been threatened has yet to be observed. A perfidious approach to classified ad fraud led to losses for one victim. Fraudsters' attempts to lure people into dubious investment offers are becoming more and more sophisticated.

22.07.2021 - In order to test the security of the COVID-19 certificate, the NCSC conducted a public security test, among other things. In its recently published report, the NCSC gives an overview of the vulnerabilities identified so far. The public security test is still ongoing.

20.07.2021 - The number of reports received by the NCSC remains at a moderate level. This week saw several DDoS attacks reported to the NCSC. In addition, the NCSC received reports of an attempted text message scam on Facebook.

13.07.2021 - The number of reports received by the NCSC fell slightly last week. In two cases, different approaches were used to try to persuade victims to download malware. In order to prevent the software from being analysed, these files can often be downloaded only once.

08.07.2021 -UPDATE: There is currently a critical vulnerability in printer spoolers of Microsoft systems. Microsoft has now made the first updates available. The NCSC recommends applying the patches immediately.

06.07.2021 - The NCSC received an average number of reports last week. There was a good illustration of how fraudsters obtain credentials for real estate portals. There was also a very sophisticated example of advance fee fraud. In this case, an apparent payment confirmation for EUR 414,900 was received. The victims were even able to log into the fake account and make a small withdrawal.

05.07.2021 - Hackers are currently exploiting a vulnerability at the US IT service provider Kaseya. The firm's customers, which include hundreds of companies worldwide, are now in the attackers' sights. They are encrypting company data and demanding a ransom. As yet, the NCSC has not received any reports of Swiss companies being affected.

02.07.2021 - A critical vulnerability that affects the Windows Print Spooler service of Microsoft systems currently exists. Despite the updates provided by Microsoft at the beginning of June, the vulnerability can be exploited using PrintNightmare. The NCSC recommends, as a matter of urgency, disabling the print spooler service on servers that are not used for printing.

01.07.2021 - From 10 to 21 May 2021, the NCSC conducted a bug bounty pilot project in collaboration with Bug Bounty Switzerland GmbH, the Federal Department of Foreign Affairs (FDFA) and Parliamentary Services (PS). The project was very successful and the lessons learned are to be incorporated into the implementation of further bug bounty programmes in the Federal Administration.

29.06.2021 - The NCSC received an average number of reports last week. Notable reports include those of CEO fraud, where the CEO's email account was most likely actually hacked, as well as reports of phishing emails that subsequently turned out to be legitimate.

22.06.2021 - The NCSC again received a moderate number of reports last week. Numerous reports of text messages advertising a COVID-19 test subscription are examples of what to watch out for when it comes to advertising. A link to a supposed voice message, circulated via text message, leads to the Flubot malware. The page is only displayed if it is accessed from an Android smartphone.

17.06.2021 - The survey of the Swiss general public and SMEs on the further development of the NCSC's contact point for cybersecurity is in full swing. The feedback already received reveals some interesting trends. We would be pleased if you would also let us know your needs and suggestions, whether you are a private individual or an SME. The survey runs until mid-July 2021.

15.06.2021 - The number of reports received by the NCSC was moderate last week. A case of CEO fraud exemplified how important the dual control principle is in preventing loss. Fraudulent emails requesting the payment of supposed parcel and customs fees have been circulating for months. Many such messages coincide with orders that have actually been placed. Although those who report these scams are under the impression that the fraudsters must have access to the systems of the Federal Customs Administration or Swiss Post to do so, this is not the case.

08.06.2021 - Last week, the number of incidents reported to the NCSC was low. There was good news for victims of Avaddon ransomware: the "No More Ransom" project published a decryption tool for this ransomware. Another noteworthy item was a fake competition spread via WhatsApp in which people could apparently win a Rolex watch. In addition, the NCSC received reports of a new tactic in fake support calls: instead of a phone call, victims received an email asking them to call back, ostensibly to update their Norton virus protection.

01.06.2021 - Last week, the NCSC received slightly more reports than in the previous week. Notable reports concerned a Swisscom invoice that had supposedly been paid twice. This was a phishing attempt. In addition, a victim of investment fraud was contacted by an alleged "regulator" who promised help.

31.05.2021 - Between now and the end of June 2021, the COVID-19 certificate system will be implemented with the solution of the Federal Office of Information Technology, Systems and Telecommunication (FOITT). The first certificates will be issued gradually in the cantons during a pilot phase set to start on 7 June. The system will be rolled out across Switzerland by the end of June. As it is to provide a very high level of security, it will be subjected to a broad public security test. Effective immediately, the source code of the first version of the Swiss COVID-19 certificate system is available for this public security test.

25.05.2021 - Last week, the NCSC received an average number of reports. Notable reports included those on CEO fraud, a new approach to classified ad scams and a well-known method of spreading malware.

17.05.2021 - Last week, the NCSC once again received a slightly higher number of reports, which can be attributed to a spate of fake sextortion. Other notable reports included a fictitious hotel looking for employees and requiring payment in advance, as well as a crude text message aimed at collecting supposed debts.

11.05.2021 - The NCSC's first semi-annual report deals with the most important cyberincidents of the second half of 2020 in Switzerland and internationally. It replaces the former MELANI semi-annual report. The main topic is digitalisation in the healthcare sector and the challenges it faces with regard to current cyberthreats.

11.05.2021 - The NCSC received a moderate number of reports last week. Reports were made of fake support calls combined with pop-up windows as well as fraudulent calendar entries being sent. In addition, it received information about bills from mobile phone providers that had allegedly been paid twice and a fake Migros competition.

10.05.2021 - The Federal Administration and Bug Bounty Switzerland GmbH will launch a joint pilot project today. The aim of the two-week test, which will be overseen by the NCSC, is to gather initial experience with bug bounty programmes and assess their future use in relation to the security of infrastructures in administrations and companies.

04.05.2021 - The NCSC received a moderate number of reports last week. Aside from phishing attempts in the name of financial service providers and Swiss providers, ransomware attacks on QNAP devices remained a key issue. In the case of classified ads, there have been frequent reports of the scam variant in which the seller is first supposed to pay the buyer a fee. In a new variant of this type, the fraudsters even managed to hack into the seller's e-banking account.

27.04.2021 - Last week, the NCSC recorded a very high number of reports. This was mainly due to a wave of fake sextortion attempts. The NCSC also received reports on emails threatening an acid attack. In addition, the NCSC is receiving an increasing number of reports on encrypted QNAP network-attached storage (NAS).

21.04.2021 - On the 20th April, security researchers have published information about several vulnerabilities in two Security-Products, affecting Pulse Secure and SonicWall. Current information shows that these vulnerabilities are already actively being exploited by unknown threat actors in targeted attacks, used to gain access to victim’s network (zero day exploitation).

20.04.2021 - Last week, the NCSC recorded fewer reports than usual. Most reports concerned classified ad and investment fraud. A new approach attracted attention, in which companies are made aware of alleged "trivial" security vulnerabilities or missing security settings. The perpetrators speculated on unsettling the recipients and thus persuading them to pay a sum of money. Also of note are attempted scams involving phone-paid services, in which fraudulent amounts are charged directly to mobile phone bills.

15.04.2021 - Microsoft had already disclosed Exchange Server vulnerabilities in March and provided corresponding patches. New vulnerabilities have now emerged and need to be patched immediately.

13.04.2021 - The NCSC received few reports last week. Most of them concerned fake sextortion. Fraudulent competitions in the name of well-known Swiss companies were also circulating again. In two cases, the bank account number (IBAN) was manipulated in invoices. This was triggered by the compromised email servers of two foreign suppliers, where the invoice was intercepted. In addition, investment fraudsters are becoming increasingly brazen. A promotional email promised earnings of EUR 12,000 for an investment of just EUR 250 – all in 72 hours!

07.04.2021 - You can now find information from the NCSC about cybersecurity topics on LinkedIn. As well as gaining an insight into the areas covered by the NCSC and its activities, you can read about appearances by and news relating to Florian Schütz, the Federal Cybersecurity Delegate. You will also find the latest news about the implementation of the national strategy for the protection of Switzerland against cyber-risks (NCS), which is coordinated by the NCSC. And if the NCSC is looking for new staff, these jobs will additionally be advertised on LinkedIn. Interested? Follow us on LinkedIn

06.04.2021 - Last week, the number of reports received by the NCSC was low. Most of the reports that came in concerned fake sextortion and phishing attacks against financial institutions or providers. One type of phishing attempt stood out in particular: the attackers went to great lengths to gain their victims' trust, and then struck in the final stage to obtain login and credit card data. It also emerged at the weekend that the data of over 500 million users that was stolen from Facebook in 2019 had been published online. Swiss Facebook users are also affected.

01.04.2021 - In order to simplify the structure and the content of the specifications regarding IT security and cyber-risks in the Federal Administration, the existing Federal Council directives on ICT security in the Federal Administration are being transferred to the Cyber-Risks Ordinance (CyRO). Due to this revision, the directives on ICT security issued by the Federal Cybersecurity Delegate have had to be adjusted accordingly. The revised CyRO will enter into force on 1 April 2021.

29.03.2021 - The number of reports received by the NCSC was slightly higher last week. Reports involving fake sextortion are on the rise again. The other most frequently reported incidents were phishing emails and fake support calls. Particularly striking were emails purportedly advertising bitcoin investments, as well as apparent attempts to deliver parcels accompanied by a phone call aimed at installing malware.

22.03.2021 - The number of reports received by the NCSC was moderate last week. Phishing emails and fake support calls were the most frequently reported incidents. However, nine reports in connection with ransomware were also received. The large sums lost in investment fraud cases were particularly striking.

12.03.2021 - During the last days, there have been numerous media reports about various vulnerabilities in Microsoft Exchange servers. The NCSC assumes that several hundred systems in Switzerland are affected by the vulnerability. Cybercriminals have now started to attack Microsoft Exchange servers that have previously been compromised, encrypting them with a new ransomware called "DoejCrypt" . We recommend to immediately patch and check your Exchange servers for infections!

04.03.2021 - Can you find the information that you need on our website? Would you recommend our website to others? We would be pleased to receive your feedback!

22.02.2021 - Bug Bounty Switzerland GmbH has convened an Advisory Board made up of IT security experts from various industries. Florian Schütz, Switzerland’s Federal Cybersecurity Delegate, is the latest member of the Advisory Board.

17.02.2021 - Quad9, the global, not-for-profit Domain Name System (DNS) security platform, today announced that it has moved its headquarters to Switzerland. The NCSC supports this move.

21.12.2020 - From today, cyberincidents can be reported to the National Cybersecurity Centre (NCSC) with a user-defined form. The NCSC's newly overhauled website will go live on the same date.