Home / Threat intelligence
Ransomware Intelligence
CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.
361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
234
victims posted (30 days)
410
groups tracked
Vendors most exploited by ransomware
Most common weaknesses (CWE)
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Most active groups (30 days)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.
| Group | Victims | Last activity |
|---|---|---|
| N0n | 63 | 15h |
| thegentlemen | 35 | 5h |
| qilin | 21 | 1d |
| Wallstreet | 15 | 1d |
| lockbit5 | 9 | 10h |
| play | 9 | 1d |
| incransom | 7 | 1d |
| THE SEVEN DEADLY SINS | 7 | 1d |
| everest | 7 | 19h |
| iah6477 | 7 | 2d |
| akira | 6 | 2d |
| interlock | 6 | 5d |
Most affected countries (30 days)
- United States71
- Brazil15
- South Korea11
- Sweden10
- United Kingdom8
- Japan6
- Spain5
- Germany5
- India5
- Australia4
Most affected sectors (30 days)
- Transportation32
- Professional Services27
- Healthcare27
- Manufacturing25
- Technology22
- Other14
- Retail & E-Commerce11
- Financial Services11
- Agriculture and Food Production8
- Education7
Groups and the CVEs they exploit
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs used in ransomware campaigns
361 result(s)
CVE-2012-4681
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-284 Aug 27, 2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVE-2015-1701
High · 7.8
KEV Urgent · 96 Public exploit Ransomware Apr 21, 2015
Microsoft Win32k Privilege Escalation Vulnerability
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
CVE-2015-7645
High · 7.8
KEV Urgent · 74 Public exploit Ransomware Oct 15, 2015
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVE-2016-0099
High · 7.8
KEV Urgent · 86 Public exploit Ransomware CWE-120 Mar 9, 2016
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVE-2016-1019
Critical · 9.8
KEV Urgent · 70 Ransomware Apr 7, 2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVE-2016-4117
Critical · 9.8
KEV Urgent · 100 Public exploit Ransomware May 10, 2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2018-8581
High · 7.4
KEV Urgent · 72 Public exploit Ransomware Nov 13, 2018
Microsoft Exchange Server Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2021-41379
Medium · 5.5
KEV High · 63 Ransomware CWE-59 Nov 9, 2021
Microsoft Windows Installer Privilege Escalation Vulnerability
Windows Installer Elevation of Privilege Vulnerability
CVE-2022-24682
Medium · 6.1
KEV High · 67 Public exploit Ransomware CWE-116 Feb 9, 2022
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CVE-2018-15982
High · 7.8
KEV Urgent · 80 Public exploit Ransomware CWE-416 Jan 18, 2019
Adobe Flash Player Use-After-Free Vulnerability
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2018-20250
High · 7.8
KEV Urgent · 96 Public exploit Ransomware CWE-22 Feb 5, 2019
WinRAR Absolute Path Traversal Vulnerability
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CVE-2018-8174
High · 7.5
KEV Urgent · 90 Public exploit Ransomware CWE-787 May 9, 2018
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2019-0752
High · 7.5
KEV Urgent · 80 Public exploit Ransomware CWE-843 Apr 9, 2019
Microsoft Internet Explorer Type Confusion Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
CVE-2017-0144
High · 8.8
KEV Urgent · 86 Public exploit Ransomware Mar 16, 2017
Microsoft SMBv1 Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
CVE-2017-0145
High · 8.8
KEV Urgent · 86 Public exploit Ransomware Mar 16, 2017
Microsoft SMBv1 Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.
CVE-2017-10271
High · 7.5
KEV Urgent · 99 Public exploit Ransomware CWE-306 Oct 19, 2017
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2020-0796
Critical · 10.0
KEV Urgent · 93 Public exploit Ransomware CWE-119 Mar 12, 2020
Microsoft SMBv3 Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVE-2022-21882
High · 7.8
KEV Urgent · 84 Public exploit Ransomware CWE-787 Jan 11, 2022
Microsoft Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2020-0787
High · 7.8
KEV Urgent · 84 Public exploit Ransomware CWE-59 Mar 12, 2020
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
CVE-2021-20038
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-121 Dec 8, 2021
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
CVE-2018-8453
High · 7.8
KEV Urgent · 86 Public exploit Ransomware Oct 10, 2018
Microsoft Win32k Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2021-21975
High · 7.5
KEV Urgent · 89 Public exploit Ransomware CWE-918 Mar 31, 2021
VMware Server Side Request Forgery in vRealize Operations Manager API
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2019-1579
High · 8.1
KEV Urgent · 72 Public exploit Ransomware CWE-134 Jul 19, 2019
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
CVE-2018-13383
Medium · 6.5
KEV High · 63 Ransomware CWE-787 May 29, 2019
Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
CVE-2018-13382
High · 7.5
KEV Urgent · 83 Public exploit Ransomware CWE-863 Jun 4, 2019
Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.