CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
258
victims posted (30 days)
410
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 70 9h
thegentlemen 35 1d
qilin 27 4h
Wallstreet 15 2d
lockbit5 9 1d
play 9 1d
iah6477 8 5h
THE SEVEN DEADLY SINS 7 2d
incransom 7 2d
everest 7 1d
akira 6 3d
interlock 6 6d
All groups →

Most affected countries (30 days)

  • United States85
  • Brazil15
  • South Korea11
  • Sweden10
  • United Kingdom8
  • Germany6
  • Japan6
  • Singapore5
  • India5
  • Thailand5

Most affected sectors (30 days)

  • Transportation34
  • Professional Services30
  • Manufacturing30
  • Healthcare28
  • Technology23
  • Other16
  • Retail & E-Commerce11
  • Financial Services11
  • Energy & Utilities9
  • Agriculture and Food Production8

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

117 result(s)

CVE-2023-23376 High · 7.8 KEV High · 65 Ransomware CWE-787 Feb 14, 2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-41080 High · 8.8 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2022
Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-44698 Medium · 5.4 KEV High · 63 Ransomware Dec 13, 2022
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-41073 High · 7.8 KEV High · 64 Ransomware CWE-787 Nov 9, 2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-41091 Medium · 5.4 KEV High · 60 Ransomware CWE-863 Nov 9, 2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2022-41040 High · 8.8 KEV Urgent · 94 Public exploit Ransomware CWE-918 Oct 2, 2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-41082 High · 8.0 KEV Urgent · 94 Public exploit Ransomware CWE-502 Oct 2, 2022
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-37969 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-787 Sep 13, 2022
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-30190 High · 7.8 KEV Urgent · 84 Public exploit Ransomware Jun 1, 2022
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
CVE-2013-0074 High · 7.8 KEV Urgent · 86 Public exploit Ransomware Mar 12, 2013
Microsoft Silverlight Double Dereference Vulnerability
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
CVE-2016-0034 High · 8.8 KEV High · 66 Ransomware Jan 13, 2016
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CVE-2016-3351 Medium · 6.5 KEV High · 63 Ransomware Sep 14, 2016
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2017-0147 High · 7.5 KEV Urgent · 89 Public exploit Ransomware Mar 16, 2017
Microsoft Windows SMBv1 Information Disclosure Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
CVE-2019-1130 High · 7.8 KEV High · 63 Ransomware CWE-59 Jul 15, 2019
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
CVE-2019-1385 High · 7.8 KEV High · 64 Ransomware CWE-59 Nov 12, 2019
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
CVE-2020-0638 High · 7.8 KEV High · 64 Ransomware CWE-59 Jan 14, 2020
Microsoft Update Notification Manager Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
CVE-2022-24521 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-787 Apr 15, 2022
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-42278 High · 7.5 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42287 High · 7.5 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2017-0148 High · 8.1 KEV Urgent · 86 Public exploit Ransomware CWE-20 Mar 16, 2017
Microsoft SMBv1 Server Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
CVE-2013-2551 High · 8.8 KEV Urgent · 86 Public exploit Ransomware CWE-416 Mar 11, 2013
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVE-2016-0151 High · 7.8 KEV Urgent · 74 Public exploit Ransomware CWE-269 Apr 12, 2016
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVE-2016-0189 High · 7.5 KEV Urgent · 86 Public exploit Ransomware CWE-787 May 10, 2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2017-0213 High · 7.3 KEV Urgent · 90 Public exploit Ransomware May 12, 2017
Microsoft Windows Privilege Escalation Vulnerability
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
CVE-2018-8405 High · 7.8 KEV High · 64 Ransomware CWE-404 Aug 15, 2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.