Battling Ransomware One Tag At A Time | Grey Noise Blog
Summary: In October 2023, as part of its Ransomware Vulnerability Warning Pilot, CISA began tagging entries in its Known Exploited Vulnerabilities catalog to designate whether exploits for a vulnerability are known to be used in ransomware attacks. GreyNoise reports it has observed recent activity in 63 tags CISA identified as associated with ransomware attacks, spanning collaboration tools like Atlassian Confluence and JetBrains TeamCity, email platforms like Microsoft Exchange, middleware such as JBoss and WebLogic, and devices from SonicWall, Ivanti, Citrix and Fortinet.
Key Takeaway: Cloud deployments top GreyNoise's ransomware tag activity list, with attackers targeting misconfigurations in highly dynamic environments, and the targeted platforms range well beyond remote access tools. With 63 ransomware-linked tags showing recent activity, defenders cannot assume any single technology category is out of reach.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026