Início / Inteligência de ameaças
Ransomware Intelligence
A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.
361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados
Fabricantes mais explorados por ransomware
Fraquezas (CWE) mais comuns
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Grupos mais ativos (30 dias)
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.
Países mais afetados (30 dias)
- Estados Unidos25
- Suécia10
- Brasil8
- Coreia do Sul8
- Reino Unido5
- Singapura4
- Índia4
- Espanha3
- Alemanha3
- Japão3
Setores mais afetados (30 dias)
- Transportation28
- Professional Services19
- Healthcare13
- Manufacturing11
- Other10
- Retail & E-Commerce8
- Technology7
- Financial Services3
- Energy & Utilities3
- Hospitality2
Grupos e as CVEs que exploram
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs usadas em campanhas de ransomware
132 resultado(s)
CVE-2022-26501
Crítica · 9.8
KEV Urgente · 72 Ransomware CWE-306 17/03/2022
Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVE-2022-26500
Alta · 8.8
KEV Alta · 65 Ransomware CWE-22 17/03/2022
Veeam Backup & Replication Remote Code Execution Vulnerability
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
CVE-2022-44698
Média · 5.4
KEV Alta · 63 Ransomware 13/12/2022
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-42475
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware CWE-787 02/01/2023
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
CVE-2022-41073
Alta · 7.8
KEV Alta · 63 Ransomware CWE-787 09/11/2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-41091
Média · 5.4
KEV Alta · 60 Ransomware CWE-863 09/11/2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2018-19320
Alta · 7.8
KEV Alta · 64 Ransomware 21/12/2018
GIGABYTE Multiple Products Unspecified Vulnerability
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
CVE-2018-19321
Alta · 7.8
KEV Alta · 64 Ransomware 21/12/2018
GIGABYTE Multiple Products Privilege Escalation Vulnerability
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CVE-2018-19322
Alta · 7.8
KEV Alta · 63 Ransomware CWE-749 21/12/2018
GIGABYTE Multiple Products Code Execution Vulnerability
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVE-2018-19323
Crítica · 9.8
KEV Alta · 69 Ransomware 21/12/2018
GIGABYTE Multiple Products Privilege Escalation Vulnerability
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVE-2020-3153
Média · 6.5
KEV Urgente · 75 Exploit público Ransomware CWE-427 19/02/2020
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
CVE-2020-3433
Alta · 7.8
KEV Urgente · 77 Exploit público Ransomware CWE-427 17/08/2020
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
CVE-2022-41352
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-22 25/09/2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
CVE-2022-40684
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-287 18/10/2022
Fortinet Multiple Products Authentication Bypass Vulnerability
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVE-2022-41040
Alta · 8.8
KEV Urgente · 94 Exploit público Ransomware CWE-918 02/10/2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-41082
Alta · 8.0
KEV Urgente · 94 Exploit público Ransomware CWE-502 02/10/2022
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-37969
Alta · 7.8
KEV Urgente · 72 Exploit público Ransomware CWE-787 13/09/2022
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2018-13374
Média · 4.3
KEV Urgente · 71 Exploit público Ransomware CWE-732 22/01/2019
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
CVE-2018-6530
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-78 06/03/2018
D-Link Multiple Routers OS Command Injection Vulnerability
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
CVE-2022-27593
Crítica · 9.1
KEV Urgente · 77 Exploit público Ransomware CWE-610 08/09/2022
QNAP Photo Station Externally Controlled Reference Vulnerability
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
CVE-2022-2294
Alta · 8.8
KEV Alta · 66 Ransomware CWE-787 27/07/2022
WebRTC Heap Buffer Overflow Vulnerability
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-26352
Crítica · 9.8
KEV Urgente · 89 Exploit público Ransomware 17/07/2022
dotCMS Unrestricted Upload of File Vulnerability
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVE-2022-37042
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-22 12/08/2022
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVE-2022-27925
Alta · 7.2
KEV Urgente · 89 Exploit público Ransomware CWE-22 20/04/2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
CVE-2022-30333
Alta · 7.5
KEV Urgente · 87 Exploit público Ransomware CWE-22 09/05/2022
RARLAB UnRAR Directory Traversal Vulnerability
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.