CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
152
victims posted (30 days)
409
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 43 12h
qilin 20 7h
Wallstreet 14 9h
lockbit5 8 12h
incransom 7 5h
iah6477 7 11h
akira 6 15h
interlock 6 3d
play 5 3d
AuditTeam 3 2d
Dark Project 3 3d
Emperador 3 19h
All groups →

Most affected countries (30 days)

  • United States38
  • Sweden10
  • Brazil9
  • South Korea9
  • United Kingdom7
  • Singapore4
  • Spain4
  • Japan4
  • India4
  • Germany3

Most affected sectors (30 days)

  • Transportation29
  • Professional Services23
  • Manufacturing16
  • Healthcare14
  • Other12
  • Technology12
  • Retail & E-Commerce9
  • Financial Services5
  • Agriculture and Food Production5
  • Energy & Utilities4

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

11 result(s)

CVE-2023-38203 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 20, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-29300 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 12, 2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2010-2861 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Aug 11, 2010
Adobe ColdFusion Directory Traversal Vulnerability
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
CVE-2009-3960 Medium · 6.5 KEV Urgent · 83 Public exploit Ransomware Feb 15, 2010
Adobe BlazeDS Information Disclosure Vulnerability
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CVE-2008-2992 High · 7.8 KEV Urgent · 86 Public exploit Ransomware CWE-787 Nov 4, 2008
Adobe Reader and Acrobat Input Validation Vulnerability
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CVE-2010-0188 High · 7.8 KEV Urgent · 86 Public exploit Ransomware Feb 22, 2010
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2015-7645 High · 7.8 KEV Urgent · 74 Public exploit Ransomware Oct 15, 2015
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVE-2016-1019 Critical · 9.8 KEV Urgent · 70 Ransomware Apr 7, 2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVE-2016-4117 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware May 10, 2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2018-15982 High · 7.8 KEV Urgent · 80 Public exploit Ransomware CWE-416 Jan 18, 2019
Adobe Flash Player Use-After-Free Vulnerability
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2018-4878 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-416 Feb 6, 2018
Adobe Flash Player Use-After-Free Vulnerability
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.