CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 13 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 1 d
AuditTeam 3 2 d
Dark Project 3 3 d
lockbit5 3 1 d
Emperador 3 8 h
everest 3 2 d
iah6477 3 6 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

43 resultado(s)

CVE-2019-1388 Alta · 7.8 KEV Alta · 65 Ransomware CWE-269 12/11/2019
Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.
CVE-2021-27878 Alta · 8.8 KEV Urgente · 78 Exploit público Ransomware 01/03/2021
Veritas Backup Exec Agent Command Execution Vulnerability
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
CVE-2021-27877 Crítica · 9.8 KEV Urgente · 89 Exploit público Ransomware 01/03/2021
Veritas Backup Exec Agent Improper Authentication Vulnerability
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
CVE-2021-27876 Alta · 8.1 KEV Urgente · 77 Exploit público Ransomware 01/03/2021
Veritas Backup Exec Agent File Access Vulnerability
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
CVE-2017-7494 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 30/05/2017
Samba Remote Code Execution Vulnerability
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVE-2023-24880 Média · 4.4 KEV Alta · 63 Ransomware CWE-863 14/03/2023
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-36537 Alta · 7.5 KEV Urgente · 79 Exploit público Ransomware 26/08/2022
ZK Framework AuUploader Unspecified Vulnerability
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
CVE-2022-40765 Média · 6.8 KEV Alta · 62 Ransomware CWE-77 21/11/2022
Mitel MiVoice Connect Command Injection Vulnerability
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
CVE-2022-41223 Média · 6.8 KEV Alta · 62 Ransomware CWE-94 21/11/2022
Mitel MiVoice Connect Code Injection Vulnerability
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
CVE-2022-47986 Crítica · 9.8 KEV Urgente · 91 Exploit público Ransomware CWE-502 17/02/2023
IBM Aspera Faspex Code Execution Vulnerability
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVE-2023-23376 Alta · 7.8 KEV Alta · 65 Ransomware CWE-787 14/02/2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-0669 Alta · 7.2 KEV Urgente · 86 Exploit público Ransomware CWE-502 06/02/2023
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CVE-2022-24990 Alta · 7.5 KEV Urgente · 89 Exploit público Ransomware CWE-306 07/02/2023
TerraMaster OS Remote Command Execution Vulnerability
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CVE-2015-2291 Alta · 7.8 KEV Urgente · 83 Exploit público Ransomware CWE-20 09/08/2017
Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
CVE-2022-21587 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 18/10/2022
Oracle E-Business Suite Unspecified Vulnerability
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2017-11357 Crítica · 9.8 KEV Urgente · 81 Exploit público Ransomware CWE-434 23/08/2017
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVE-2022-47966 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-20 18/01/2023
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
CVE-2022-41080 Alta · 8.8 KEV Urgente · 72 Exploit público Ransomware 09/11/2022
Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.