Ransomware criminals love CISA's KEV list – and that's a bug, not a feature

GreyNoise's Mass Internet Exploitation Report finds active and widespread exploitation of known and legacy vulnerabilities in 2024—many used for ransomware and botnet activity—with a notable portion of CVEs listed in CISA's KEV catalog being leveraged by attackers. The report calls out critical, high-impact flaws (including multiple 9.8-rated RCEs), documents vendor patching and disclosure failures (Ivanti, D-Link, VMware/Broadcom), and warns organizations to strengthen patching, monitoring, and consider vendor/product risk given automation-driven exploitation at scale.