Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361

CVEs used by ransomware · 21% of the KEV catalog

added in the last 90 days

173

critical

229

victims posted (30 days)

410

groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

202627
202531
202444
202343
2022132
202184

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

Group	Victims	Last activity
N0n	63	9h
thegentlemen	31	1d
qilin	21	1d
Wallstreet	15	1d
lockbit5	9	4h
play	9	19h
incransom	7	1d
THE SEVEN DEADLY SINS	7	1d
everest	7	12h
iah6477	7	1d
akira	6	2d
interlock	6	5d

All groups →

Most affected countries (30 days)

United States70
Brazil15
South Korea11
Sweden10
United Kingdom8
Japan6
Spain5
Germany5
India5
Australia4

Most affected sectors (30 days)

Transportation32
Professional Services27
Healthcare25
Manufacturing25
Technology21
Other14
Financial Services11
Retail & E-Commerce10
Agriculture and Food Production8
Energy & Utilities6

CVEs used in ransomware campaigns

11 result(s)

CVE-2025-29824 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-416 Apr 8, 2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2024-9680 Critical · 9.8 KEV Urgent · 79 Public exploit Ransomware CWE-416 Oct 9, 2024

Mozilla Firefox Use-After-Free Vulnerability

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

CVE-2024-1086 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-416 Jan 31, 2024

Linux Kernel Use-After-Free Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2013-2551 High · 8.8 KEV Urgent · 86 Public exploit Ransomware CWE-416 Mar 11, 2013

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.

CVE-2018-15982 High · 7.8 KEV Urgent · 80 Public exploit Ransomware CWE-416 Jan 18, 2019

Adobe Flash Player Use-After-Free Vulnerability

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2021-40449 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-416 Oct 12, 2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2020-3992 Critical · 9.8 KEV Urgent · 79 Public exploit Ransomware CWE-416 Oct 20, 2020

VMware ESXi OpenSLP Use-After-Free Vulnerability

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVE-2021-22893 Critical · 10.0 KEV Urgent · 79 Public exploit Ransomware CWE-416 Apr 23, 2021

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CVE-2021-26411 High · 8.8 KEV Urgent · 82 Public exploit Ransomware CWE-416 Mar 11, 2021

Microsoft Internet Explorer Memory Corruption Vulnerability

Internet Explorer Memory Corruption Vulnerability

CVE-2019-0708 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-416 May 16, 2019

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

CVE-2018-4878 High · 7.8 KEV Urgent · 90 Public exploit Ransomware CWE-416 Feb 6, 2018