CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
221
vítimas divulgadas (30 dias)
410
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 60 7 h
thegentlemen 31 19 h
qilin 21 22 h
Wallstreet 15 13 h
play 9 8 h
lockbit5 8 1 d
incransom 7 1 d
THE SEVEN DEADLY SINS 7 19 h
iah6477 7 1 d
akira 6 1 d
interlock 6 4 d
Dark Project 3 4 d
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos67
  • Brasil15
  • Suécia10
  • Coreia do Sul10
  • Reino Unido8
  • Espanha5
  • Alemanha5
  • Japão5
  • Índia5
  • Austrália4

Setores mais afetados (30 dias)

  • Transportation31
  • Professional Services27
  • Healthcare25
  • Manufacturing23
  • Technology20
  • Other14
  • Financial Services11
  • Retail & E-Commerce10
  • Agriculture and Food Production8
  • Energy & Utilities6

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

117 resultado(s)

CVE-2023-23376 Alta · 7.8 KEV Alta · 65 Ransomware CWE-787 14/02/2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-41080 Alta · 8.8 KEV Urgente · 72 Exploit público Ransomware 09/11/2022
Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-44698 Média · 5.4 KEV Alta · 63 Ransomware 13/12/2022
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-41073 Alta · 7.8 KEV Alta · 64 Ransomware CWE-787 09/11/2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-41091 Média · 5.4 KEV Alta · 60 Ransomware CWE-863 09/11/2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2022-41040 Alta · 8.8 KEV Urgente · 94 Exploit público Ransomware CWE-918 02/10/2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-41082 Alta · 8.0 KEV Urgente · 94 Exploit público Ransomware CWE-502 02/10/2022
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-37969 Alta · 7.8 KEV Urgente · 72 Exploit público Ransomware CWE-787 13/09/2022
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-30190 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware 01/06/2022
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
CVE-2013-0074 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware 12/03/2013
Microsoft Silverlight Double Dereference Vulnerability
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
CVE-2016-0034 Alta · 8.8 KEV Alta · 66 Ransomware 13/01/2016
Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
CVE-2016-3351 Média · 6.5 KEV Alta · 63 Ransomware 14/09/2016
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2017-0147 Alta · 7.5 KEV Urgente · 89 Exploit público Ransomware 16/03/2017
Microsoft Windows SMBv1 Information Disclosure Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
CVE-2019-1130 Alta · 7.8 KEV Alta · 63 Ransomware CWE-59 15/07/2019
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
CVE-2019-1385 Alta · 7.8 KEV Alta · 64 Ransomware CWE-59 12/11/2019
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
CVE-2020-0638 Alta · 7.8 KEV Alta · 64 Ransomware CWE-59 14/01/2020
Microsoft Update Notification Manager Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
CVE-2022-24521 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-787 15/04/2022
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-42278 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42287 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2017-0148 Alta · 8.1 KEV Urgente · 86 Exploit público Ransomware CWE-20 16/03/2017
Microsoft SMBv1 Server Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
CVE-2013-2551 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-416 11/03/2013
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVE-2016-0151 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware CWE-269 12/04/2016
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVE-2016-0189 Alta · 7.5 KEV Urgente · 86 Exploit público Ransomware CWE-787 10/05/2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2017-0213 Alta · 7.3 KEV Urgente · 90 Exploit público Ransomware 12/05/2017
Microsoft Windows Privilege Escalation Vulnerability
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
CVE-2018-8405 Alta · 7.8 KEV Alta · 64 Ransomware CWE-404 15/08/2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.