CISA's KEV list informs ransomware attacks, paper suggests

Fresh research suggests attackers are actively monitoring databases of vulnerabilities that are known to be useful in carrying out ransomware attacks. GreyNoise's annual Mass Internet Exploitation Report revealed this week that 28 percent of the bugs logged in CISA's Known Exploited Vulnerability (KEV) catalog were also used by ransomware criminals in 2024. It's a logical assumption to make that attackers would see the KEV list as a useful tool to help them plan their attacks. It notes the vulnerabilities that others have seen success in exploiting, shows whether they were used in ransomware attacks, and usually provides links to all the relevant documentation explaining how the exploits work. The KEV program is aimed at improving patching in the US public sector, but evidence suggests it's also having an unintended yet welcome effect on the private sector. GreyNoise's data showed not all KEV catalog listings were inspirational for ransomware slingers. Some bugs were exploited by extortionists just before CISA added them to the KEV catalog. Some examples here include the remote code execution (RCE) issue in Cleo Harmony (CVE-2024-50623), which, according to GreyNoise, was exploited in early 2024 but only made it to the KEV list in December after a mass exploitation campaign began. Then there's the perfect 10 critical command execution vulnerability in Progress's Kemp LoadMaster (CVE-2024-1212), which was disclosed to the National Vulnerability Database in February 2024 but no...