Ransomware Groups and the Vulnerabilities They Exploit
Ransomware groups and the vulnerabilities they exploit form a distinct domain because exam scenarios usually start with a CVE and ask you to recognise the operator behind the intrusion.
Groups to know
- LockBit - ran a large RaaS programme; LockBit 3.0 (Black) shipped a builder that leaked in 2022. Operation Cronos in February 2024 seized infrastructure and indicted its figurehead, yet affiliates and copycats persisted. Associated with Citrix Bleed (CVE-2023-4966) and double extortion.
- Clop (Cl0p) - mass exploitation of managed file transfer appliances: Accellion FTA, GoAnywhere MFT (CVE-2023-0669) and MOVEit Transfer (CVE-2023-34362, SQL injection leading to web-shell deployment). Clop frequently steals data and extorts without encrypting.
- BlackCat/ALPHV - Rust-based encryptor, affiliate model, VMware ESXi targeting, and the Change Healthcare intrusion in 2024 before an exit scam pushed affiliates toward RansomHub.
Vulnerabilities that recur
Log4Shell (CVE-2021-44228), ProxyShell (CVE-2021-34473), PrintNightmare (CVE-2021-34527), Citrix Bleed, ScreenConnect (CVE-2024-1709) and Fortinet SSL-VPN path traversal (CVE-2018-13379) remain reliable initial access.
Worked example
A MOVEit server shows w3wp.exe spawning cmd.exe, then a .asp file written into the upload directory, followed by large outbound transfers. Reasoning: IIS worker processes do not normally spawn shells; the web shell is the persistence and collection stage; outbound volume indicates theft rather than encryption. That pattern matches Clop's MOVEit campaign, so the priority is scoping exfiltration and meeting disclosure duties, not restoring encrypted files.
Traps
- Assuming Clop always encrypts - it often does not.
- Confusing BlackCat with the older BlackMatter or DarkSide.
- Believing a takedown ends the threat; affiliates rebrand quickly.
- Patching only the headline CVE while the initial access vector stays open.