CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
121
victims posted (30 days)
408
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 41 13h
Wallstreet 13 1d
qilin 9 1d
interlock 6 3d
play 5 2d
akira 3 1d
AuditTeam 3 2d
Dark Project 3 3d
lockbit5 3 1d
Emperador 3 8h
everest 3 2d
iah6477 3 6h
All groups →

Most affected countries (30 days)

  • United States25
  • Sweden10
  • Brazil8
  • South Korea8
  • United Kingdom5
  • Singapore4
  • India4
  • Spain3
  • Germany3
  • Japan3

Most affected sectors (30 days)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

13 result(s)

CVE-2024-57728 High · 7.2 KEV Urgent · 70 Public exploit Ransomware CWE-59 Jan 15, 2025
SimpleHelp Path Traversal Vulnerability
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
CVE-2025-60710 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-59 Nov 11, 2025
Microsoft Windows Link Following Vulnerability
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2019-1130 High · 7.8 KEV High · 63 Ransomware CWE-59 Jul 15, 2019
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
CVE-2019-1385 High · 7.8 KEV High · 64 Ransomware CWE-59 Nov 12, 2019
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
CVE-2020-0638 High · 7.8 KEV High · 64 Ransomware CWE-59 Jan 14, 2020
Microsoft Update Notification Manager Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
CVE-2019-0841 High · 7.8 KEV Urgent · 86 Public exploit Ransomware CWE-59 Apr 9, 2019
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.
CVE-2019-1064 High · 7.8 KEV High · 65 Ransomware CWE-59 Jun 12, 2019
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.
CVE-2019-1069 High · 7.8 KEV High · 65 Ransomware CWE-59 Jun 12, 2019
Microsoft Task Scheduler Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
CVE-2019-1129 High · 7.8 KEV High · 63 Ransomware CWE-59 Jul 15, 2019
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
CVE-2019-1253 High · 7.8 KEV Urgent · 73 Public exploit Ransomware CWE-59 Sep 11, 2019
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
CVE-2019-1315 High · 7.8 KEV High · 64 Ransomware CWE-59 Oct 10, 2019
Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.
CVE-2021-41379 Medium · 5.5 KEV High · 63 Ransomware CWE-59 Nov 9, 2021
Microsoft Windows Installer Privilege Escalation Vulnerability
Windows Installer Elevation of Privilege Vulnerability
CVE-2020-0787 High · 7.8 KEV Urgent · 78 Public exploit Ransomware CWE-59 Mar 12, 2020
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.