Home / Threat intelligence
Ransomware Intelligence
CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.
361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
301
victims posted (30 days)
410
groups tracked
Vendors most exploited by ransomware
Most common weaknesses (CWE)
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Most active groups (30 days)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.
| Group | Victims | Last activity |
|---|---|---|
| N0n | 86 | 7h |
| qilin | 36 | 15h |
| thegentlemen | 35 | 2d |
| Wallstreet | 15 | 3d |
| lockbit5 | 10 | 16h |
| play | 9 | 3d |
| incransom | 8 | 20h |
| iah6477 | 8 | 2d |
| Helix | 7 | 1d |
| everest | 7 | 3d |
| THE SEVEN DEADLY SINS | 7 | 4d |
| akira | 6 | 5d |
Most affected countries (30 days)
- United States106
- Brazil16
- South Korea12
- Sweden10
- United Kingdom9
- Germany9
- Spain6
- Japan6
- India6
- Singapore5
Most affected sectors (30 days)
- Transportation38
- Professional Services34
- Manufacturing34
- Healthcare30
- Technology27
- Other18
- Retail & E-Commerce15
- Financial Services14
- Education10
- Energy & Utilities9
Groups and the CVEs they exploit
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs used in ransomware campaigns
44 result(s)
CVE-2024-30051
High · 7.8
KEV Urgent · 71 Public exploit Ransomware CWE-787 May 14, 2024
Microsoft DWM Core Library Privilege Escalation Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-3400
Critical · 10.0
KEV Urgent · 100 Public exploit Ransomware CWE-77 Apr 12, 2024
Palo Alto Networks PAN-OS Command Injection Vulnerability
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
CVE-2023-24955
High · 7.2
KEV Urgent · 84 Public exploit Ransomware CWE-94 May 9, 2023
Microsoft SharePoint Server Code Injection Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-48788
Critical · 9.8
KEV Urgent · 100 Public exploit Ransomware CWE-89 Mar 12, 2024
Fortinet FortiClient EMS SQL Injection Vulnerability
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2021-44529
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-94 Dec 8, 2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2024-27198
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-288 Mar 4, 2024
JetBrains TeamCity Authentication Bypass Vulnerability
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
CVE-2024-21338
High · 7.8
KEV Urgent · 80 Public exploit Ransomware CWE-822 Feb 13, 2024
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-1709
Critical · 10.0
KEV Urgent · 100 Public exploit Ransomware CWE-288 Feb 21, 2024
ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to confidential information or
critical systems.
CVE-2020-3259
High · 7.5
KEV High · 69 Ransomware CWE-200 May 6, 2020
Cisco ASA and FTD Information Disclosure Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVE-2024-21412
High · 8.1
KEV Urgent · 72 Public exploit Ransomware CWE-693 Feb 13, 2024
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2024-21762
Critical · 9.8
KEV Urgent · 79 Public exploit Ransomware CWE-787 Feb 9, 2024
Fortinet FortiOS Out-of-Bound Write Vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVE-2024-21893
High · 8.2
KEV Urgent · 89 Public exploit Ransomware CWE-918 Jan 31, 2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2023-22527
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-74 Jan 16, 2024
Atlassian Confluence Data Center and Server Template Injection Vulnerability
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.
Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CVE-2023-35082
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-287 Aug 15, 2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2024-21887
Critical · 9.1
KEV Urgent · 90 Public exploit Ransomware CWE-77 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805
High · 8.2
KEV Urgent · 99 Public exploit Ransomware CWE-287 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-29357
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-303 Jun 13, 2023
Microsoft SharePoint Server Privilege Escalation Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-38203
Critical · 9.8
KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 20, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-29300
Critical · 9.8
KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 12, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.