CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 13 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 1 d
AuditTeam 3 2 d
Dark Project 3 3 d
lockbit5 3 1 d
Emperador 3 8 h
everest 3 2 d
iah6477 3 6 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

132 resultado(s)

CVE-2020-0638 Alta · 7.8 KEV Alta · 64 Ransomware CWE-59 14/01/2020
Microsoft Update Notification Manager Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
CVE-2022-1388 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 05/05/2022
F5 BIG-IP Missing Authentication Vulnerability
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-29464 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 18/04/2022
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CVE-2018-6882 Média · 6.1 KEV Alta · 67 Exploit público Ransomware CWE-79 27/03/2018
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
CVE-2019-16057 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-78 16/09/2019
D-Link DNS-320 Remote Code Execution Vulnerability
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
CVE-2022-22954 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 11/04/2022
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2018-20753 Crítica · 9.8 KEV Urgente · 73 Ransomware 05/02/2019
Kaseya VSA Remote Code Execution Vulnerability
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
CVE-2018-7602 Crítica · 9.8 KEV Urgente · 82 Exploit público Ransomware CWE-94 19/07/2018
Execução remota de código no Drupal Core (CVE-2018-7602)
Existe uma vulnerabilidade de execução remota de código em múltiplos subsistemas do Drupal 7.x e 8.x. Isso potencialmente permite que atacantes explorem múltiplos vetores de ataque em um site Drupal, o que pode resultar no comprometimento do site. Esta vulnerabilidade está relacionada ao núcleo do Drupal - Altamente crítica - Execução remota de código - SA-CORE-2018-002. Tanto a SA-CORE-2018-002 quanto esta vulnerabilidade estão sendo exploradas na natureza.
CVE-2022-24521 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-787 15/04/2022
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-42278 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42287 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2017-0148 Alta · 8.1 KEV Urgente · 86 Exploit público Ransomware CWE-20 16/03/2017
Microsoft SMBv1 Server Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
CVE-2018-10562 Crítica · 9.8 KEV Urgente · 85 Exploit público Ransomware CWE-78 04/05/2018
Dasan GPON Routers Command Injection Vulnerability
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
CVE-2021-28799 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-285 13/05/2021
QNAP NAS Improper Authorization Vulnerability
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CVE-2013-2465 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-693 18/06/2013
Oracle Java SE Unspecified Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVE-2013-2551 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-416 11/03/2013
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVE-2016-0151 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware CWE-269 12/04/2016
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVE-2016-0189 Alta · 7.5 KEV Urgente · 86 Exploit público Ransomware CWE-787 10/05/2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2017-0213 Alta · 7.3 KEV Urgente · 84 Exploit público Ransomware 12/05/2017
Microsoft Windows Privilege Escalation Vulnerability
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
CVE-2018-8405 Alta · 7.8 KEV Alta · 64 Ransomware CWE-404 15/08/2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.
CVE-2018-8406 Alta · 7.8 KEV Alta · 64 Ransomware CWE-404 15/08/2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.
CVE-2018-8440 Alta · 7.8 KEV Urgente · 78 Exploit público Ransomware 12/09/2018
Microsoft Windows Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2021-20028 Crítica · 9.8 KEV Urgente · 73 Ransomware CWE-89 04/08/2021
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
CVE-2021-26085 Média · 5.3 KEV Urgente · 78 Exploit público Ransomware CWE-425 02/08/2021
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CVE-2021-38646 Alta · 7.8 KEV Alta · 65 Ransomware 15/09/2021
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.