Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361

CVEs used by ransomware · 21% of the KEV catalog

added in the last 90 days

173

critical

215

victims posted (30 days)

409

groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

202627
202531
202444
202343
2022132
202184

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

Group	Victims	Last activity
N0n	59	6h
thegentlemen	31	13h
qilin	21	15h
Wallstreet	15	6h
lockbit5	8	1d
incransom	7	23h
the-seven-deadly-sins	7	13h
iah6477	7	1d
akira	6	1d
interlock	6	4d
play	5	3d
Dark Project	3	4d

All groups →

Most affected countries (30 days)

United States66
Brazil14
Sweden10
South Korea10
United Kingdom8
Spain5
Germany5
Japan5
India5
Australia4

Most affected sectors (30 days)

Transportation31
Professional Services27
Healthcare25
Manufacturing21
Technology19
Other14
Retail & E-Commerce10
Financial Services9
Agriculture and Food Production8
Education6

CVEs used in ransomware campaigns

84 result(s)

CVE-2021-43890 High · 7.1 KEV High · 65 Ransomware Dec 15, 2021

Microsoft Windows AppX Installer Spoofing Vulnerability

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.

CVE-2021-44228 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-20 Dec 10, 2021

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVE-2017-12149 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Oct 4, 2017

Red Hat JBoss Application Server Remote Code Execution Vulnerability

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

CVE-2021-40438 Critical · 9.0 KEV Urgent · 83 Public exploit Ransomware CWE-918 Sep 16, 2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2021-42321 High · 8.8 KEV Urgent · 84 Public exploit Ransomware Nov 9, 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-40449 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-416 Oct 12, 2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2021-40539 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-706 Sep 7, 2021

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

CVE-2021-21985 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-918 May 26, 2021

VMware vCenter Server Improper Input Validation Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

CVE-2021-21972 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Feb 24, 2021

VMware vCenter Server Remote Code Execution Vulnerability

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

CVE-2021-22005 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Sep 23, 2021

VMware vCenter Server File Upload Vulnerability

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

CVE-2020-3992 Critical · 9.8 KEV Urgent · 79 Public exploit Ransomware CWE-416 Oct 20, 2020

VMware ESXi OpenSLP Use-After-Free Vulnerability

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVE-2019-5544 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-787 Dec 6, 2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2020-12271 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-89 Apr 27, 2020

Sophos SFOS SQL Injection Vulnerability

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)

CVE-2021-20016 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-89 Feb 4, 2021

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.

CVE-2021-20023 Medium · 4.9 KEV High · 66 Ransomware CWE-22 Apr 20, 2021

SonicWall Email Security Path Traversal Vulnerability

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

CVE-2021-20022 High · 7.2 KEV High · 69 Ransomware CWE-434 Apr 9, 2021

SonicWall Email Security Unrestricted Upload of File Vulnerability

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

CVE-2019-7481 High · 7.5 KEV Urgent · 73 Public exploit Ransomware CWE-89 Dec 17, 2019

SonicWall SMA100 SQL Injection Vulnerability

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.

CVE-2021-20021 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-269 Apr 9, 2021

SonicWall Email Security Improper Privilege Management Vulnerability

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

CVE-2021-35211 Critical · 10.0 KEV Urgent · 80 Public exploit Ransomware CWE-787 Jul 14, 2021

SolarWinds Serv-U Remote Code Execution Vulnerability

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

CVE-2018-2380 Medium · 6.6 KEV Urgent · 77 Public exploit Ransomware CWE-22 Mar 1, 2018

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

CVE-2019-11539 High · 7.2 KEV Urgent · 86 Public exploit Ransomware CWE-78 Apr 25, 2019

Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

CVE-2019-11510 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-22 May 8, 2019

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .

CVE-2021-22893 Critical · 10.0 KEV Urgent · 79 Public exploit Ransomware CWE-416 Apr 23, 2021

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CVE-2019-18935 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-502 Dec 11, 2019

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

CVE-2021-36955 High · 7.8 KEV Urgent · 71 Public exploit Ransomware Sep 15, 2021

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.