CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 12 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 23 h
AuditTeam 3 2 d
Dark Project 3 2 d
lockbit5 3 1 d
Emperador 3 7 h
everest 3 2 d
iah6477 3 5 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

10 resultado(s)

CVE-2026-15409 Crítica · 10.0 KEV Urgente · 92 Exploit público Ransomware CWE-918 14/07/2026
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
CVE-2024-21893 Alta · 8.2 KEV Urgente · 89 Exploit público Ransomware CWE-918 31/01/2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2022-41040 Alta · 8.8 KEV Urgente · 94 Exploit público Ransomware CWE-918 02/10/2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-21975 Alta · 7.5 KEV Urgente · 85 Exploit público Ransomware CWE-918 31/03/2021
VMware Server Side Request Forgery in vRealize Operations Manager API
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2021-40438 Crítica · 9.0 KEV Urgente · 77 Exploit público Ransomware CWE-918 16/09/2021
Apache HTTP Server-Side Request Forgery (SSRF)
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-21985 Crítica · 9.8 KEV Urgente · 89 Exploit público Ransomware CWE-918 26/05/2021
VMware vCenter Server Improper Input Validation Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVE-2021-26855 Crítica · 9.1 KEV Urgente · 100 Exploit público Ransomware CWE-918 02/03/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-34473 Crítica · 9.1 KEV Urgente · 99 Exploit público Ransomware CWE-918 14/07/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-22986 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-918 31/03/2021
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVE-2021-27103 Crítica · 9.8 KEV Alta · 69 Ransomware CWE-918 16/02/2021
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.