Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361

CVEs used by ransomware · 21% of the KEV catalog

added in the last 90 days

173

critical

155

victims posted (30 days)

409

groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

202627
202531
202444
202343
2022132
202184

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

Group	Victims	Last activity
N0n	46	5h
qilin	20	9h
Wallstreet	14	11h
lockbit5	8	14h
incransom	7	7h
iah6477	7	13h
akira	6	17h
interlock	6	3d
play	5	3d
AuditTeam	3	2d
Dark Project	3	3d
Emperador	3	21h

All groups →

Most affected countries (30 days)

United States40
Sweden10
Brazil9
South Korea9
United Kingdom7
Singapore4
Spain4
Japan4
India4
Germany3

Most affected sectors (30 days)

Transportation29
Professional Services23
Manufacturing16
Healthcare15
Other12
Technology12
Retail & E-Commerce9
Financial Services5
Agriculture and Food Production5
Energy & Utilities4

CVEs used in ransomware campaigns

8 result(s)

CVE-2024-1086 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-416 Jan 31, 2024

Linux Kernel Use-After-Free Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2023-46604 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Oct 27, 2023

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVE-2017-12615 High · 8.1 KEV Urgent · 84 Public exploit Ransomware CWE-434 Sep 19, 2017

Apache Tomcat on Windows Remote Code Execution Vulnerability

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVE-2021-44228 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-20 Dec 10, 2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVE-2021-40438 Critical · 9.0 KEV Urgent · 83 Public exploit Ransomware CWE-918 Sep 16, 2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2017-5638 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-755 Mar 10, 2017

Apache Struts Remote Code Execution Vulnerability

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

CVE-2021-41773 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Oct 5, 2021

Apache HTTP Server Path Traversal Vulnerability

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVE-2021-42013 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Oct 7, 2021