Getting A Leg Up On Initial Access Ransomware With CISA KEV and Grey Noise Tags | Grey Noise Blog

Summary: CISA has added a field to its Known Exploited Vulnerabilities catalog marking whether a KEV CVE has been used in ransomware attacks, and more than two hundred KEV CVEs now carry that designation. About 75 of those, roughly 35%, have corresponding GreyNoise tags, and GreyNoise states that most ransomware exploits in KEV fall outside the remote Initial Access category its sensors are built to catch.
What's compelling: More than two hundred known-exploited vulnerabilities are now flagged as ransomware-used, and GreyNoise's own figures put its coverage at about 35% of them - so a KEV-only patching view leaves the majority of that ransomware set without the detection data described here.

Read the original at GreyNoise Blog ↗