Patterns and Targets for Ransomware Exploitation of Vulnerabilities: 2017–2023

This Insikt Group analysis reviews six years of ransomware-vulnerability activity, finding that a small set of widely used enterprise flaws (ProxyShell, ZeroLogon, Log4Shell, CVE-2021-34527, CVE-2019-19781) attracted the most actor attention and are often easily exploited via simple code or penetration-testing modules; by contrast, vulnerabilities exploited by only one group typically require custom vectors. The report recommends rapid patching of widely exploited critical vulnerabilities, minimizing public HTTP/S exposure, monitoring security research for proof-of-concept patterns, and tracking criminal discussions of vendors/products rather than specific CVEs, and notes that advances in generative AI could further lower attackers' technical barrier in the near future.