Magnitude exploit kitKaspersky Securelist·Jun 24, 10:00 UTC · Jun 24, 2020Ransomware in the wildCVE-2018-8174CVE-2018-8653CVE-2019-1367+3 CVEs60
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022Kaspersky Securelist·Dec 21, 10:28 UTC · Dec 21, 2023Ransomware in the wildCVE-2022-24521CVE-2023-23376CVE-2023-28252+2 CVEs60
Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023Kaspersky Securelist·Dec 21, 10:30 UTC · Dec 21, 2023Ransomware in the wildCVE-2022-24521CVE-2023-23376CVE-2023-2825260
Running for Office: Russian APT Toolkits RevealedRecorded Future·Jun 27, 00:00 UTC · Jun 27, 2025Ransomware in the wildCVE-2014-3897CVE-2013-3897260
Windows CLFS and five exploits used by ransomware operators (Exploit #2Kaspersky Securelist·Dec 21, 10:29 UTC · Dec 21, 2023Ransomware in the wildCVE-2022-24521CVE-2023-23376CVE-2023-28252+2 CVEs60
March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC ZeroRecorded Future·Jun 3, 00:00 UTC · Jun 3, 2026Ransomware in the wildCVE-2017-7921CVE-2026-27483CVE-2026-27944+10 CVEs260
Google: China dominates government exploitation of zeroSecurity Affairs·Mar 28, 12:16 UTC · Mar 28, 2024Ransomware in the wild60
React2Shell fallout spreads to sensitive targets as public exploits hit allCyberScoop·Dec 18, 16:12 UTC · Dec 18, 2025Ransomware in the wildCVE-2025-55182CVE-2025-55183CVE-2025-67779+1 CVEs60
Storm-2603 spotted deploying ransomware on exploited SharePoint serversHelp Net Security·Aug 4, 12:44 UTC · Aug 4, 2025Ransomware in the wildCVE-2025-53770CVE-2025-49706CVE-2025-49704+2 CVEs60
April 2026 CVE LandscapeRecorded Future·Jun 3, 00:00 UTC · Jun 3, 2026Ransomware in the wildCVE-2026-33032CVE-2026-39987CVE-2009-0238+30 CVEs60
Experts warn of a surge in zeroSecurity Affairs·Apr 25, 08:09 UTC · Apr 25, 2022Ransomware in the wild160
⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AIThe Hacker News·Jun 2, 03:39 UTC · Jun 2, 2026Ransomware in the wildCVE-2026-0257CVE-2026-8732CVE-2026-27771+31 CVEs60
Google says 90 zero-days exploited in 2025 as commercial vendor activity growsThe Record·Mar 5, 15:01 UTC · Mar 5, 2026Ransomware in the wildCVE-2025-21590CVE-2025-0282CVE-2025-61882+2 CVEs60
October 2025 CVE LandscapeRecorded Future·Dec 9, 00:00 UTC · Dec 9, 2025Ransomware in the wildCVE-2025-59287CVE-2025-61882CVE-2025-41244+29 CVEs60
ProxyLogon Microsoft Exchange exploit is completely out of the bagSecurity Affairs·Mar 15, 12:56 UTC · Mar 15, 2021Ransomware in the wildCVE-2021-2685560
Zyxel Fixes 0day in Network Storage DevicesKrebs on Security·Feb 24, 18:06 UTC · Feb 24, 2020Ransomware in the wildCVE-2020-905460
From exploits to honeypots: How the security community is preparing for BlueKeep’s moment of truthCyberScoop·Jul 9, 19:01 UTC · Jul 9, 2019Ransomware in the wild60
Magnitude exploit kit now include also the CVE-2015Security Affairs·Dec 1, 08:47 UTC · Dec 1, 2018Ransomware in the wildCVE-2015-3113CVE-2015-03113CVE-2015-310560
Hackers Exploit Critical Langflow Bug in Just 20 HoursInfosecurity Magazine·Mar 20, 10:20 UTC · Mar 20, 2026Ransomware in the wildCVE-2026-33017160
U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs·Feb 18, 10:55 UTC · Feb 18, 2026Ransomware in the wildCVE-2008-0015CVE-2020-7796CVE-2024-7694+1 CVEs60
Cyber experts and officials raise alarms about exploits against Citrix and Apache productsThe Record·Nov 3, 18:13 UTC · Nov 3, 2023Ransomware in the wildCVE-2023-46604CVE-2023-496660
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and MoreThe Hacker News·May 19, 04:33 UTC · May 19, 2026Ransomware in the wildCVE-2026-42897CVE-2026-20182CVE-2026-2012760
Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in RealThe Hacker News·Oct 8, 04:30 UTC · Oct 8, 2025Ransomware in the wildCVE-2025-6188260
Oracle patches critical E-Business Suite flaw exploited by Cl0p hackersSecurity Affairs·Oct 6, 19:51 UTC · Oct 6, 2025Ransomware in the wildCVE-2025-6188260
Cybercrime group exploits Windows zeroSecurity Affairs·Apr 12, 05:10 UTC · Apr 12, 2023Ransomware in the wildCVE-2023-2825260
New Microsoft Exchange exploit chain lets ransomware attackers in (CVE-2022-41080)Help Net Security·Dec 21, 00:00 UTC · Dec 21, 2022Ransomware in the wildCVE-2022-41080CVE-2022-41082CVE-2022-4104060
June 2026 CVE LandscapeRecorded Future·Jul 17, 00:00 UTC · Jul 17, 2026Ransomware in the wildCVE-2026-35616CVE-2026-25939CVE-2020-17103+53 CVEs60
SonicWall customers under threat as attackers exploit 2 zeroCyberScoop·Jul 15, 18:52 UTC · Jul 15, 2026Ransomware in the wildCVE-2026-15409CVE-2026-1541060
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & MoreThe Hacker News·Mar 19, 14:25 UTC · Mar 19, 2026Ransomware in the wildCVE-2024-55591CVE-2025-71257CVE-2025-71258+4 CVEs60
Hackers seen exploiting bugs in browsers and popular file transfer toolThe Record·Oct 3, 13:21 UTC · Oct 3, 2023Ransomware in the wildCVE-2023-5217CVE-2023-4004460
IT threat evolution Q1 2018. StatisticsKaspersky Securelist·May 14, 10:00 UTC · May 14, 2018Ransomware in the wild160
July 2026 CVE LandscapeRecorded Future·Aug 7, 00:00 UTC · Aug 7, 2026Ransomware in the wildCVE-2025-3248CVE-2008-4128CVE-2017-17215+78 CVEs160
Cleo patches zero-day exploited by ransomware gangHelp Net Security·Jun 8, 10:32 UTC · Jun 8, 2026Ransomware in the wildCVE-2024-50623CVE-2024-55956160
China-Linked Hackers Exploit VMware ESXi ZeroThe Hacker News·Jan 12, 16:25 UTC · Jan 12, 2026Ransomware in the wildCVE-2025-22224CVE-2025-22225CVE-2025-2222660
Attackers hit React defect as researchers quibble over proofCyberScoop·Dec 6, 17:14 UTC · Dec 6, 2025Ransomware in the wildCVE-2025-55182CVE-2025-6647860
IR Trends Q3 2025: ToolShell attacks dominate, highlighting criticality of segmentation and rapid responseCisco Talos·Oct 23, 10:00 UTC · Oct 23, 2025Ransomware in the wildCVE-2025-53770CVE-2025-53771CVE-2025-49704+1 CVEs60
Fortra cops to exploitation of GoAnywhere fileCyberScoop·Oct 13, 21:22 UTC · Oct 13, 2025Ransomware in the wildCVE-2025-1003560
Worries mount over maxCyberScoop·Sep 26, 14:30 UTC · Sep 26, 2025Ransomware in the wildCVE-2025-10035CVE-2023-066960
Clop gang was testing MOVEit Transfer bug since 2021Security Affairs·Jun 9, 12:49 UTC · Jun 9, 2023Ransomware in the wildCVE-2023-34362CVE-2023-066960
CISA issues directive for exploited VMware bug after IR team deployed to ‘large’ orgThe Record·Jan 12, 00:00 UTC · Jan 12, 2023Ransomware in the wildCVE-2022-22954CVE-2022-22972CVE-2022-22973+1 CVEs60