CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
269
victims posted (30 days)
410
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 77 7h
thegentlemen 35 1d
qilin 28 11h
Wallstreet 15 2d
lockbit5 9 1d
play 9 2d
iah6477 8 20h
incransom 7 3d
Helix 7 6h
THE SEVEN DEADLY SINS 7 2d
everest 7 2d
akira 6 3d
All groups →

Most affected countries (30 days)

  • United States90
  • Brazil15
  • South Korea12
  • Sweden10
  • United Kingdom8
  • Germany7
  • Japan6
  • Singapore5
  • India5
  • Thailand5

Most affected sectors (30 days)

  • Transportation34
  • Professional Services31
  • Manufacturing31
  • Healthcare28
  • Technology25
  • Other16
  • Retail & E-Commerce12
  • Financial Services12
  • Education9
  • Energy & Utilities9

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

117 result(s)

CVE-2017-0145 High · 8.8 KEV Urgent · 86 Public exploit Ransomware Mar 16, 2017
Microsoft SMBv1 Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.
CVE-2020-0796 Critical · 10.0 KEV Urgent · 93 Public exploit Ransomware CWE-119 Mar 12, 2020
Microsoft SMBv3 Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVE-2022-21882 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-787 Jan 11, 2022
Microsoft Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2020-0787 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-59 Mar 12, 2020
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
CVE-2018-8453 High · 7.8 KEV Urgent · 86 Public exploit Ransomware Oct 10, 2018
Microsoft Win32k Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2019-1458 High · 7.8 KEV Urgent · 86 Public exploit Ransomware Dec 10, 2019
Microsoft Win32k Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
CVE-2021-43890 High · 7.1 KEV High · 65 Ransomware Dec 15, 2021
Microsoft Windows AppX Installer Spoofing Vulnerability
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
CVE-2021-42321 High · 8.8 KEV Urgent · 84 Public exploit Ransomware Nov 9, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-40449 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-416 Oct 12, 2021
Microsoft Windows Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2021-36955 High · 7.8 KEV Urgent · 71 Public exploit Ransomware Sep 15, 2021
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-26857 High · 7.8 KEV Urgent · 82 Public exploit Ransomware CWE-502 Mar 2, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2019-0604 Critical · 9.8 KEV Urgent · 97 Public exploit Ransomware CWE-20 Mar 5, 2019
Microsoft SharePoint Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
CVE-2021-1675 High · 7.8 KEV Urgent · 84 Public exploit Ransomware Jun 8, 2021
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Windows Print Spooler Remote Code Execution Vulnerability
CVE-2021-27065 High · 7.8 KEV Urgent · 99 Public exploit Ransomware CWE-22 Mar 2, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 High · 7.8 KEV Urgent · 79 Ransomware Mar 2, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26855 Critical · 9.1 KEV Urgent · 100 Public exploit Ransomware CWE-918 Mar 2, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2020-1472 Medium · 5.5 KEV Urgent · 96 Public exploit Ransomware Aug 17, 2020
Microsoft Netlogon Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
CVE-2020-0968 High · 7.5 KEV High · 66 Ransomware CWE-787 Apr 15, 2020
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.
CVE-2017-0199 High · 7.8 KEV Urgent · 96 Public exploit Ransomware Apr 12, 2017
Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
CVE-2019-1367 High · 7.5 KEV Urgent · 72 Public exploit Ransomware CWE-787 Sep 23, 2019
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
CVE-2017-11882 High · 7.8 KEV Urgent · 96 Public exploit Ransomware CWE-119 Nov 15, 2017
Microsoft Office Memory Corruption Vulnerability
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
CVE-2012-0158 High · 8.8 KEV Urgent · 96 Public exploit Ransomware CWE-94 Apr 10, 2012
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVE-2018-0802 High · 7.8 KEV Urgent · 82 Public exploit Ransomware CWE-787 Jan 9, 2018
Microsoft Office Memory Corruption Vulnerability
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
CVE-2019-1215 High · 7.8 KEV Urgent · 80 Public exploit Ransomware CWE-269 Sep 11, 2019
Microsoft Windows Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
CVE-2021-36942 High · 7.5 KEV Urgent · 81 Public exploit Ransomware Aug 12, 2021
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Windows LSA Spoofing Vulnerability

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.