Home / Threat intelligence
Ransomware Intelligence
CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.
361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
317
victims posted (30 days)
412
groups tracked
Vendors most exploited by ransomware
Most common weaknesses (CWE)
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Most active groups (30 days)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.
| Group | Victims | Last activity |
|---|---|---|
| N0n | 88 | 10h |
| qilin | 36 | 1d |
| thegentlemen | 35 | 3d |
| Wallstreet | 15 | 4d |
| lockbit5 | 10 | 1d |
| incransom | 9 | 4h |
| play | 9 | 4d |
| iah6477 | 8 | 2d |
| Helix | 7 | 1d |
| THE SEVEN DEADLY SINS | 7 | 4d |
| everest | 7 | 3d |
| akira | 6 | 5d |
Most affected countries (30 days)
- United States118
- Brazil16
- South Korea12
- United Kingdom10
- Sweden10
- Germany9
- Spain6
- Japan6
- India6
- Singapore5
Most affected sectors (30 days)
- Transportation38
- Manufacturing36
- Professional Services34
- Healthcare34
- Technology29
- Other19
- Retail & E-Commerce15
- Financial Services14
- Education11
- Agriculture and Food Production9
Groups and the CVEs they exploit
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs used in ransomware campaigns
27 result(s)
CVE-2026-23760
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-288 Jan 22, 2026
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.
CVE-2025-52691
Critical · 10.0
KEV Urgent · 93 Public exploit Ransomware CWE-434 Dec 29, 2025
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.
Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.