CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 13 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 1 d
AuditTeam 3 2 d
Dark Project 3 3 d
lockbit5 3 1 d
Emperador 3 8 h
everest 3 2 d
iah6477 3 6 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

44 resultado(s)

CVE-2024-30051 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-787 14/05/2024
Microsoft DWM Core Library Privilege Escalation Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-3400 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-77 12/04/2024
Palo Alto Networks PAN-OS GlobalProtect: injeção de comandos sem autenticação (CVE-2024-3400)
Uma vulnerabilidade de injeção de comandos, resultante de criação arbitrária de arquivos, no recurso GlobalProtect do software PAN-OS da Palo Alto Networks, para versões específicas do PAN-OS e configurações distintas de recursos, pode permitir que um atacante não autenticado execute código arbitrário com privilégios de root no firewall. Cloud NGFW, appliances Panorama e Prisma Access não são impactados por esta vulnerabilidade.
CVE-2023-24955 Alta · 7.2 KEV Urgente · 84 Exploit público Ransomware CWE-94 09/05/2023
Microsoft SharePoint Server Code Injection Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-48788 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-89 12/03/2024
Fortinet FortiClient EMS SQL Injection Vulnerability
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2021-44529 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 08/12/2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2024-27198 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-288 04/03/2024
JetBrains TeamCity Authentication Bypass Vulnerability
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
CVE-2024-21338 Alta · 7.8 KEV Urgente · 80 Exploit público Ransomware CWE-822 13/02/2024
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-1709 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-288 21/02/2024
ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
CVE-2020-3259 Alta · 7.5 KEV Alta · 69 Ransomware CWE-200 06/05/2020
Cisco ASA and FTD Information Disclosure Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVE-2024-21412 Alta · 8.1 KEV Urgente · 72 Exploit público Ransomware CWE-693 13/02/2024
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2024-21762 Crítica · 9.8 KEV Urgente · 79 Exploit público Ransomware CWE-787 09/02/2024
Fortinet FortiOS Out-of-Bound Write Vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVE-2024-21893 Alta · 8.2 KEV Urgente · 89 Exploit público Ransomware CWE-918 31/01/2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2023-22527 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-74 16/01/2024
Atlassian Confluence Data Center and Server Template Injection Vulnerability
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CVE-2023-35082 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-287 15/08/2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2024-21887 Crítica · 9.1 KEV Urgente · 90 Exploit público Ransomware CWE-77 12/01/2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805 Alta · 8.2 KEV Urgente · 99 Exploit público Ransomware CWE-287 12/01/2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-29357 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-303 13/06/2023
Microsoft SharePoint Server Privilege Escalation Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-38203 Crítica · 9.8 KEV Urgente · 87 Exploit público Ransomware CWE-502 20/07/2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-29300 Crítica · 9.8 KEV Urgente · 87 Exploit público Ransomware CWE-502 12/07/2023
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.