CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
332
victims posted (30 days)
412
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 95 6h
qilin 36 1d
thegentlemen 35 3d
Wallstreet 15 5d
lockbit5 10 1d
incransom 9 21h
play 9 4d
iah6477 8 3d
Helix 7 2d
THE SEVEN DEADLY SINS 7 5d
everest 7 4d
Emperador 6 14h
All groups →

Most affected countries (30 days)

  • United States123
  • Brazil16
  • South Korea12
  • United Kingdom10
  • Sweden10
  • Germany9
  • Spain6
  • Japan6
  • India6
  • Singapore5

Most affected sectors (30 days)

  • Transportation38
  • Manufacturing37
  • Professional Services35
  • Healthcare34
  • Technology31
  • Other20
  • Retail & E-Commerce16
  • Financial Services14
  • Education11
  • Agriculture and Food Production9

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

84 result(s)

CVE-2021-26084 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-917 Aug 30, 2021
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
CVE-2017-5638 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-755 Mar 10, 2017
Apache Struts Remote Code Execution Vulnerability
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2021-41773 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Oct 5, 2021
Apache HTTP Server Path Traversal Vulnerability
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Oct 7, 2021
Apache HTTP Server Path Traversal Vulnerability
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2018-4878 High · 7.8 KEV Urgent · 90 Public exploit Ransomware CWE-416 Feb 6, 2018
Adobe Flash Player Use-After-Free Vulnerability
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CVE-2021-27103 Critical · 9.8 KEV High · 69 Ransomware CWE-918 Feb 16, 2021
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
CVE-2021-27101 Critical · 9.8 KEV Urgent · 75 Public exploit Ransomware Feb 16, 2021
Accellion FTA SQL Injection Vulnerability
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
CVE-2021-27102 High · 7.8 KEV High · 64 Ransomware CWE-78 Feb 16, 2021
Accellion FTA OS Command Injection Vulnerability
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
CVE-2021-27104 Critical · 9.8 KEV Urgent · 70 Ransomware CWE-78 Feb 16, 2021
Accellion FTA OS Command Injection Vulnerability
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.