Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361

CVEs used by ransomware · 21% of the KEV catalog

added in the last 90 days

173

critical

301

victims posted (30 days)

410

groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

202627
202531
202444
202343
2022132
202184

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

Group	Victims	Last activity
N0n	86	6h
qilin	36	14h
thegentlemen	35	2d
Wallstreet	15	3d
lockbit5	10	14h
play	9	3d
incransom	8	19h
iah6477	8	1d
Helix	7	1d
everest	7	3d
THE SEVEN DEADLY SINS	7	4d
akira	6	4d

All groups →

Most affected countries (30 days)

United States106
Brazil16
South Korea12
Sweden10
United Kingdom9
Germany9
Spain6
Japan6
India6
Singapore5

Most affected sectors (30 days)

Transportation38
Professional Services34
Manufacturing34
Healthcare30
Technology27
Other18
Retail & E-Commerce15
Financial Services14
Education10
Energy & Utilities9

CVEs used in ransomware campaigns

43 result(s)

CVE-2019-1388 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-269 Nov 12, 2019

Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.

CVE-2021-27878 High · 8.8 KEV Urgent · 78 Public exploit Ransomware Mar 1, 2021

Veritas Backup Exec Agent Command Execution Vulnerability

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

CVE-2021-27877 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware Mar 1, 2021

Veritas Backup Exec Agent Improper Authentication Vulnerability

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

CVE-2021-27876 High · 8.1 KEV Urgent · 83 Public exploit Ransomware Mar 1, 2021

Veritas Backup Exec Agent File Access Vulnerability

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

CVE-2017-7494 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 May 30, 2017

Samba Remote Code Execution Vulnerability

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

CVE-2023-24880 Medium · 4.4 KEV High · 63 Ransomware CWE-863 Mar 14, 2023

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2022-36537 High · 7.5 KEV Urgent · 79 Public exploit Ransomware Aug 26, 2022

ZK Framework AuUploader Unspecified Vulnerability

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

CVE-2022-40765 Medium · 6.8 KEV High · 62 Ransomware CWE-77 Nov 21, 2022

Mitel MiVoice Connect Command Injection Vulnerability

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

CVE-2022-41223 Medium · 6.8 KEV High · 62 Ransomware CWE-94 Nov 21, 2022

Mitel MiVoice Connect Code Injection Vulnerability

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVE-2022-47986 Critical · 9.8 KEV Urgent · 91 Public exploit Ransomware CWE-502 Feb 17, 2023

IBM Aspera Faspex Code Execution Vulnerability

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

CVE-2023-23376 High · 7.8 KEV High · 65 Ransomware CWE-787 Feb 14, 2023

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2023-0669 High · 7.2 KEV Urgent · 86 Public exploit Ransomware CWE-502 Feb 6, 2023

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

CVE-2022-24990 High · 7.5 KEV Urgent · 89 Public exploit Ransomware CWE-306 Feb 7, 2023

TerraMaster OS Remote Command Execution Vulnerability

TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

CVE-2015-2291 High · 7.8 KEV Urgent · 89 Public exploit Ransomware CWE-20 Aug 9, 2017

Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.

CVE-2022-21587 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-306 Oct 18, 2022

Oracle E-Business Suite Unspecified Vulnerability

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2017-11357 Critical · 9.8 KEV Urgent · 81 Public exploit Ransomware CWE-434 Aug 23, 2017

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVE-2022-47966 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-20 Jan 18, 2023

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

CVE-2022-41080 High · 8.8 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2022

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.