CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
301
vítimas divulgadas (30 dias)
410
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 86 5 h
qilin 36 13 h
thegentlemen 35 2 d
Wallstreet 15 3 d
lockbit5 10 13 h
play 9 3 d
incransom 8 18 h
iah6477 8 1 d
Helix 7 1 d
everest 7 3 d
THE SEVEN DEADLY SINS 7 4 d
akira 6 4 d
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos106
  • Brasil16
  • Coreia do Sul12
  • Suécia10
  • Reino Unido9
  • Alemanha9
  • Espanha6
  • Japão6
  • Índia6
  • Singapura5

Setores mais afetados (30 dias)

  • Transportation38
  • Professional Services34
  • Manufacturing34
  • Healthcare30
  • Technology27
  • Other18
  • Retail & E-Commerce15
  • Financial Services14
  • Education10
  • Energy & Utilities9

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

132 resultado(s)

CVE-2009-3960 Média · 6.5 KEV Urgente · 83 Exploit público Ransomware 15/02/2010
Adobe BlazeDS Information Disclosure Vulnerability
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
CVE-2008-2992 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-787 04/11/2008
Adobe Reader and Acrobat Input Validation Vulnerability
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CVE-2010-0188 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware 22/02/2010
Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2012-0507 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-843 07/06/2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVE-2012-1723 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 16/06/2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVE-2012-4681 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 27/08/2012
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVE-2015-1701 Alta · 7.8 KEV Urgente · 96 Exploit público Ransomware 21/04/2015
Microsoft Win32k Privilege Escalation Vulnerability
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
CVE-2015-7645 Alta · 7.8 KEV Urgente · 74 Exploit público Ransomware 15/10/2015
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CVE-2016-0099 Alta · 7.8 KEV Urgente · 86 Exploit público Ransomware CWE-120 09/03/2016
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVE-2016-1019 Crítica · 9.8 KEV Urgente · 70 Ransomware 07/04/2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
CVE-2016-4117 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware 10/05/2016
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2018-8581 Alta · 7.4 KEV Urgente · 72 Exploit público Ransomware 13/11/2018
Microsoft Exchange Server Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2021-41379 Média · 5.5 KEV Alta · 63 Ransomware CWE-59 09/11/2021
Microsoft Windows Installer Privilege Escalation Vulnerability
Windows Installer Elevation of Privilege Vulnerability
CVE-2022-24682 Média · 6.1 KEV Alta · 67 Exploit público Ransomware CWE-116 09/02/2022
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CVE-2018-15982 Alta · 7.8 KEV Urgente · 80 Exploit público Ransomware CWE-416 18/01/2019
Adobe Flash Player Use-After-Free Vulnerability
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2018-20250 Alta · 7.8 KEV Urgente · 96 Exploit público Ransomware CWE-22 05/02/2019
WinRAR Absolute Path Traversal Vulnerability
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CVE-2018-8174 Alta · 7.5 KEV Urgente · 90 Exploit público Ransomware CWE-787 09/05/2018
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2019-0752 Alta · 7.5 KEV Urgente · 80 Exploit público Ransomware CWE-843 09/04/2019
Microsoft Internet Explorer Type Confusion Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
CVE-2017-0144 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware 16/03/2017
Microsoft SMBv1 Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
CVE-2017-0145 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware 16/03/2017
Microsoft SMBv1 Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.
CVE-2017-10271 Alta · 7.5 KEV Urgente · 99 Exploit público Ransomware CWE-306 19/10/2017
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2020-0796 Crítica · 10.0 KEV Urgente · 93 Exploit público Ransomware CWE-119 12/03/2020
Microsoft SMBv3 Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVE-2022-21882 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-787 11/01/2022
Microsoft Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2020-0787 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-59 12/03/2020
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
CVE-2021-20038 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-121 08/12/2021
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.