Início / Inteligência de ameaças
Ransomware Intelligence
A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.
361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
258
vítimas divulgadas (30 dias)
410
grupos monitorados
Fabricantes mais explorados por ransomware
Fraquezas (CWE) mais comuns
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Grupos mais ativos (30 dias)
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.
| Grupo | Vítimas | Última atividade |
|---|---|---|
| N0n | 70 | 10 h |
| thegentlemen | 35 | 1 d |
| qilin | 27 | 5 h |
| Wallstreet | 15 | 2 d |
| lockbit5 | 9 | 1 d |
| play | 9 | 1 d |
| iah6477 | 8 | 7 h |
| THE SEVEN DEADLY SINS | 7 | 2 d |
| incransom | 7 | 2 d |
| everest | 7 | 1 d |
| akira | 6 | 3 d |
| interlock | 6 | 6 d |
Países mais afetados (30 dias)
- Estados Unidos85
- Brasil15
- Coreia do Sul11
- Suécia10
- Reino Unido8
- Alemanha6
- Japão6
- Singapura5
- Índia5
- Tailândia5
Setores mais afetados (30 dias)
- Transportation34
- Professional Services30
- Manufacturing30
- Healthcare28
- Technology23
- Other16
- Retail & E-Commerce11
- Financial Services11
- Energy & Utilities9
- Agriculture and Food Production8
Grupos e as CVEs que exploram
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs usadas em campanhas de ransomware
132 resultado(s)
CVE-2018-8453
Alta · 7.8
KEV Urgente · 86 Exploit público Ransomware 10/10/2018
Microsoft Win32k Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2021-21975
Alta · 7.5
KEV Urgente · 89 Exploit público Ransomware CWE-918 31/03/2021
VMware Server Side Request Forgery in vRealize Operations Manager API
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVE-2019-1579
Alta · 8.1
KEV Urgente · 72 Exploit público Ransomware CWE-134 19/07/2019
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
CVE-2018-13383
Média · 6.5
KEV Alta · 63 Ransomware CWE-787 29/05/2019
Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
CVE-2018-13382
Alta · 7.5
KEV Urgente · 83 Exploit público Ransomware CWE-863 04/06/2019
Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
CVE-2019-2725
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-74 26/04/2019
Oracle WebLogic Server, Injection
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2019-1458
Alta · 7.8
KEV Urgente · 86 Exploit público Ransomware 10/12/2019
Microsoft Win32k Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.