Início / Inteligência de ameaças
Ransomware Intelligence
A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.
361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
155
vítimas divulgadas (30 dias)
409
grupos monitorados
Fabricantes mais explorados por ransomware
Fraquezas (CWE) mais comuns
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Grupos mais ativos (30 dias)
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.
Países mais afetados (30 dias)
- Estados Unidos40
- Suécia10
- Brasil9
- Coreia do Sul9
- Reino Unido7
- Singapura4
- Espanha4
- Japão4
- Índia4
- Alemanha3
Setores mais afetados (30 dias)
- Transportation29
- Professional Services23
- Manufacturing16
- Healthcare15
- Other12
- Technology12
- Retail & E-Commerce9
- Financial Services5
- Agriculture and Food Production5
- Energy & Utilities4
Grupos e as CVEs que exploram
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs usadas em campanhas de ransomware
361 resultado(s)
CVE-2022-22954
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-94 11/04/2022
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2018-20753
Crítica · 9.8
KEV Urgente · 73 Ransomware 05/02/2019
Kaseya VSA Remote Code Execution Vulnerability
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
CVE-2018-7602
Crítica · 9.8
KEV Urgente · 88 Exploit público Ransomware CWE-94 19/07/2018
Execução remota de código no Drupal Core (CVE-2018-7602)
Existe uma vulnerabilidade de execução remota de código em múltiplos subsistemas do Drupal 7.x e 8.x. Isso potencialmente permite que atacantes explorem múltiplos vetores de ataque em um site Drupal, o que pode resultar no comprometimento do site. Esta vulnerabilidade está relacionada ao núcleo do Drupal - Altamente crítica - Execução remota de código - SA-CORE-2018-002. Tanto a SA-CORE-2018-002 quanto esta vulnerabilidade estão sendo exploradas na natureza.
CVE-2022-24521
Alta · 7.8
KEV Urgente · 71 Exploit público Ransomware CWE-787 15/04/2022
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-42278
Alta · 7.5
KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42287
Alta · 7.5
KEV Urgente · 72 Exploit público Ransomware 09/11/2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2017-0148
Alta · 8.1
KEV Urgente · 86 Exploit público Ransomware CWE-20 16/03/2017
Microsoft SMBv1 Server Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
CVE-2018-10562
Crítica · 9.8
KEV Urgente · 91 Exploit público Ransomware CWE-78 04/05/2018
Dasan GPON Routers Command Injection Vulnerability
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
CVE-2021-28799
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-285 13/05/2021
QNAP NAS Improper Authorization Vulnerability
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
CVE-2013-2465
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-693 18/06/2013
Oracle Java SE Unspecified Vulnerability
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVE-2013-2551
Alta · 8.8
KEV Urgente · 86 Exploit público Ransomware CWE-416 11/03/2013
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVE-2016-0151
Alta · 7.8
KEV Urgente · 74 Exploit público Ransomware CWE-269 12/04/2016
Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
CVE-2016-0189
Alta · 7.5
KEV Urgente · 86 Exploit público Ransomware CWE-787 10/05/2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2017-0213
Alta · 7.3
KEV Urgente · 90 Exploit público Ransomware 12/05/2017
Microsoft Windows Privilege Escalation Vulnerability
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
CVE-2018-8405
Alta · 7.8
KEV Alta · 64 Ransomware CWE-404 15/08/2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.
CVE-2018-8406
Alta · 7.8
KEV Alta · 64 Ransomware CWE-404 15/08/2018
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.
CVE-2018-8440
Alta · 7.8
KEV Urgente · 84 Exploit público Ransomware 12/09/2018
Microsoft Windows Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2021-20028
Crítica · 9.8
KEV Urgente · 73 Ransomware CWE-89 04/08/2021
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
CVE-2021-26085
Média · 5.3
KEV Urgente · 84 Exploit público Ransomware CWE-425 02/08/2021
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CVE-2021-38646
Alta · 7.8
KEV Alta · 65 Ransomware 15/09/2021
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
CVE-2010-2861
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-22 11/08/2010
Adobe ColdFusion Directory Traversal Vulnerability
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
CVE-2017-0146
Alta · 8.8
KEV Urgente · 86 Exploit público Ransomware 16/03/2017
Microsoft Windows SMB Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.
CVE-2017-12615
Alta · 8.1
KEV Urgente · 84 Exploit público Ransomware CWE-434 19/09/2017
Apache Tomcat on Windows Remote Code Execution Vulnerability
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2018-11138
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-78 31/05/2018
Quest KACE System Management Appliance Remote Command Execution Vulnerability
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVE-2018-1273
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-94 11/04/2018
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.