Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361

CVEs usadas por ransomware · 21% do catálogo KEV

incluídas nos últimos 90 dias

173

críticas

121

vítimas divulgadas (30 dias)

408

grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

202627
202531
202444
202343
2022132
202184

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

Grupo	Vítimas	Última atividade
N0n	41	12 h
Wallstreet	13	1 d
qilin	9	1 d
interlock	6	3 d
play	5	2 d
akira	3	23 h
AuditTeam	3	2 d
Dark Project	3	2 d
lockbit5	3	1 d
Emperador	3	7 h
everest	3	2 d
iah6477	3	5 h

Todos os grupos →

Países mais afetados (30 dias)

Estados Unidos25
Suécia10
Brasil8
Coreia do Sul8
Reino Unido5
Singapura4
Índia4
Espanha3
Alemanha3
Japão3

Setores mais afetados (30 dias)

Transportation28
Professional Services19
Healthcare13
Manufacturing11
Other10
Retail & E-Commerce8
Technology7
Financial Services3
Energy & Utilities3
Hospitality2

CVEs usadas em campanhas de ransomware

11 resultado(s)

CVE-2025-29824 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-416 08/04/2025

Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVE-2024-9680 Crítica · 9.8 KEV Urgente · 79 Exploit público Ransomware CWE-416 09/10/2024

Mozilla Firefox Use-After-Free Vulnerability

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

CVE-2024-1086 Alta · 7.8 KEV Urgente · 72 Exploit público Ransomware CWE-416 31/01/2024

Linux Kernel Use-After-Free Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2013-2551 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-416 11/03/2013

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.

CVE-2018-15982 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware CWE-416 18/01/2019

Adobe Flash Player Use-After-Free Vulnerability

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2021-40449 Alta · 7.8 KEV Urgente · 78 Exploit público Ransomware CWE-416 12/10/2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2020-3992 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-416 20/10/2020

VMware ESXi OpenSLP Use-After-Free Vulnerability

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

CVE-2021-22893 Crítica · 10.0 KEV Urgente · 73 Ransomware CWE-416 23/04/2021

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CVE-2021-26411 Alta · 8.8 KEV Urgente · 76 Ransomware CWE-416 11/03/2021

Microsoft Internet Explorer Memory Corruption Vulnerability

Internet Explorer Memory Corruption Vulnerability

CVE-2019-0708 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-416 16/05/2019

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

CVE-2018-4878 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-416 06/02/2018