Início / Inteligência de ameaças
Ransomware Intelligence
A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.
361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados
Fabricantes mais explorados por ransomware
Fraquezas (CWE) mais comuns
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Grupos mais ativos (30 dias)
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.
Países mais afetados (30 dias)
- Estados Unidos25
- Suécia10
- Brasil8
- Coreia do Sul8
- Reino Unido5
- Singapura4
- Índia4
- Espanha3
- Alemanha3
- Japão3
Setores mais afetados (30 dias)
- Transportation28
- Professional Services19
- Healthcare13
- Manufacturing11
- Other10
- Retail & E-Commerce8
- Technology7
- Financial Services3
- Energy & Utilities3
- Hospitality2
Grupos e as CVEs que exploram
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs usadas em campanhas de ransomware
84 resultado(s)
CVE-2021-43890
Alta · 7.1
KEV Alta · 65 Ransomware 15/12/2021
Microsoft Windows AppX Installer Spoofing Vulnerability
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader.
An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section.
Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability.
December 27 2023 Update:
In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme.
To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
CVE-2021-44228
Crítica · 10.0
KEV Urgente · 100 Exploit público Ransomware CWE-20 10/12/2021
Apache Log4j2 Remote Code Execution Vulnerability
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2017-12149
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware CWE-502 04/10/2017
Red Hat JBoss Application Server Remote Code Execution Vulnerability
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
CVE-2021-40438
Crítica · 9.0
KEV Urgente · 77 Exploit público Ransomware CWE-918 16/09/2021
Apache HTTP Server-Side Request Forgery (SSRF)
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-42321
Alta · 8.8
KEV Urgente · 84 Exploit público Ransomware 09/11/2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-40449
Alta · 7.8
KEV Urgente · 78 Exploit público Ransomware CWE-416 12/10/2021
Microsoft Windows Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2021-40539
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware CWE-706 07/09/2021
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVE-2021-21985
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware CWE-918 26/05/2021
VMware vCenter Server Improper Input Validation Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVE-2021-21972
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-22 24/02/2021
VMware vCenter Server Remote Code Execution Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVE-2021-22005
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware CWE-22 23/09/2021
VMware vCenter Server File Upload Vulnerability
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
CVE-2020-3992
Crítica · 9.8
KEV Urgente · 73 Ransomware CWE-416 20/10/2020
VMware ESXi OpenSLP Use-After-Free Vulnerability
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
CVE-2019-5544
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-787 06/12/2019
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVE-2020-12271
Crítica · 9.8
KEV Urgente · 73 Ransomware CWE-89 27/04/2020
Sophos SFOS SQL Injection Vulnerability
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
CVE-2021-20016
Crítica · 9.8
KEV Urgente · 73 Ransomware CWE-89 04/02/2021
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
CVE-2021-20023
Média · 4.9
KEV Alta · 66 Ransomware CWE-22 20/04/2021
SonicWall Email Security Path Traversal Vulnerability
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVE-2021-20022
Alta · 7.2
KEV Alta · 69 Ransomware CWE-434 09/04/2021
SonicWall Email Security Unrestricted Upload of File Vulnerability
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVE-2019-7481
Alta · 7.5
KEV Urgente · 73 Exploit público Ransomware CWE-89 17/12/2019
SonicWall SMA100 SQL Injection Vulnerability
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
CVE-2021-20021
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-269 09/04/2021
SonicWall Email Security Improper Privilege Management Vulnerability
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2021-35211
Crítica · 10.0
KEV Urgente · 74 Exploit público Ransomware CWE-787 14/07/2021
SolarWinds Serv-U Remote Code Execution Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
CVE-2018-2380
Média · 6.6
KEV Urgente · 71 Exploit público Ransomware CWE-22 01/03/2018
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVE-2019-11539
Alta · 7.2
KEV Urgente · 86 Exploit público Ransomware CWE-78 25/04/2019
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
CVE-2019-11510
Crítica · 10.0
KEV Urgente · 100 Exploit público Ransomware CWE-22 08/05/2019
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
CVE-2021-22893
Crítica · 10.0
KEV Urgente · 73 Ransomware CWE-416 23/04/2021
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2019-18935
Crítica · 9.8
KEV Urgente · 100 Exploit público Ransomware CWE-502 11/12/2019
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
CVE-2021-36955
Alta · 7.8
KEV Alta · 65 Exploit público Ransomware 15/09/2021
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.