CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 12 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 23 h
AuditTeam 3 2 d
Dark Project 3 2 d
lockbit5 3 1 d
Emperador 3 7 h
everest 3 2 d
iah6477 3 5 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

361 resultado(s)

CVE-2024-57727 Alta · 7.5 KEV Urgente · 89 Exploit público Ransomware CWE-22 15/01/2025
SimpleHelp Path Traversal Vulnerability
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
CVE-2020-29574 Crítica · 9.8 KEV Urgente · 72 Ransomware CWE-89 11/12/2020
CyberoamOS (CROS) SQL Injection Vulnerability
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
CVE-2025-23006 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-502 23/01/2025
SonicWall SMA1000 Appliances Deserialization Vulnerability
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
CVE-2024-55591 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-288 14/01/2025
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
CVE-2023-48365 Crítica · 9.9 KEV Urgente · 70 Ransomware CWE-444 15/11/2023
Qlik Sense HTTP Tunneling Vulnerability
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
CVE-2025-0282 Crítica · 9.0 KEV Urgente · 88 Exploit público Ransomware CWE-787 08/01/2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-41713 Crítica · 9.1 KEV Urgente · 83 Exploit público Ransomware CWE-22 21/10/2024
Mitel MiCollab Path Traversal Vulnerability
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CVE-2024-55550 Baixa · 2.7 KEV Alta · 67 Exploit público Ransomware CWE-22 10/12/2024
Mitel MiCollab Path Traversal Vulnerability
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
CVE-2024-55956 Crítica · 9.8 KEV Urgente · 86 Exploit público Ransomware CWE-77 13/12/2024
Cleo Multiple Products Unauthenticated File Upload Vulnerability
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
CVE-2024-50623 Crítica · 9.8 KEV Urgente · 80 Exploit público Ransomware CWE-434 27/10/2024
Cleo Multiple Products Unrestricted File Upload Vulnerability
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
CVE-2024-51378 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-78 29/10/2024
CyberPanel Incorrect Default Permissions Vulnerability
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVE-2024-11667 Crítica · 9.8 KEV Urgente · 71 Ransomware CWE-22 27/11/2024
Zyxel Multiple Firewalls Path Traversal Vulnerability
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
CVE-2023-28461 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-287 15/03/2023
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
CVE-2024-0012 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 18/11/2024
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVE-2024-9474 Alta · 7.2 KEV Urgente · 86 Exploit público Ransomware CWE-78 18/11/2024
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVE-2024-49039 Alta · 8.8 KEV Urgente · 71 Exploit público Ransomware CWE-287 12/11/2024
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2024-51567 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 29/10/2024
CyberPanel Incorrect Default Permissions Vulnerability
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
CVE-2024-38094 Alta · 7.2 KEV Alta · 66 Ransomware CWE-502 09/07/2024
Microsoft SharePoint Deserialization Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2024-40711 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-502 07/09/2024
Veeam Backup and Replication Deserialization Vulnerability
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
CVE-2024-30088 Alta · 7.0 KEV Urgente · 82 Exploit público Ransomware CWE-367 11/06/2024
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-9680 Crítica · 9.8 KEV Urgente · 79 Exploit público Ransomware CWE-416 09/10/2024
Mozilla Firefox Use-After-Free Vulnerability
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
CVE-2020-0618 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-502 11/02/2020
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CVE-2024-6670 Crítica · 9.8 KEV Urgente · 90 Exploit público Ransomware CWE-89 29/08/2024
Progress WhatsUp Gold SQL Injection Vulnerability
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
CVE-2017-1000253 Alta · 7.8 KEV Urgente · 73 Exploit público Ransomware CWE-119 04/10/2017
Linux Kernel PIE Stack Buffer Corruption Vulnerability
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
CVE-2024-40766 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-284 23/08/2024
SonicWall SonicOS Improper Access Control Vulnerability
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.