Géopolitique cyber & threat actors

Pays attaquants

Threat Actors connus

Acteurs observés

CVEs attribués

🌍 Pays d'origine identifiés

🇷🇺 RU26 CVE(s)

🌐 ??19 CVE(s)

🇨🇳 CN19 CVE(s)

🇰🇵 KP9 CVE(s)

🇮🇷 IR4 CVE(s)

🕵️ Threat Actors (base + observés)

🇷🇺 APT29observé11 CVE(s)

🇷🇺 APT28observé9 CVE(s)

🇰🇵 Lazarusobservé9 CVE(s)

🇨🇳 Volt Typhoonobservé9 CVE(s)

🌐 Cl0pobservé7 CVE(s)

🇨🇳 APT41observé6 CVE(s)

🇷🇺 Sandwormobservé6 CVE(s)

🌐 RansomHubobservé5 CVE(s)

🇨🇳 Salt Typhoonobservé4 CVE(s)

🇮🇷 MuddyWaterobservé4 CVE(s)

🌐 Akiraobservé3 CVE(s)

🌐 LockBitobservé2 CVE(s)

🌐 BlackCatobservé2 CVE(s)

CVEs avec attribution géopolitique

CVE-2023-44487 P0

🕵️ Sandworm🇷🇺 RUScore: 235

HTTP/2 Rapid Reset Attack Vulnerability

CVE-2021-44228 P0

🕵️ Lazarus🇰🇵 KPScore: 235

Apache Log4j2 Remote Code Execution Vulnerability

CVE-2021-26084 P0

🕵️ APT41🇨🇳 CNScore: 235

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CVE-2023-46604 P0

🕵️ RansomHub🌐 ??Score: 235

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

CVE-2024-21887 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 225

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CVE-2023-22518 P0

🕵️ LockBit🌐 ??Score: 225

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CVE-2023-4966 P0

🕵️ Akira🌐 ??Score: 225

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

CVE-2023-0669 P0

🕵️ Cl0p🌐 ??Score: 225

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

CVE-2019-19781 P0

🕵️ APT29🇷🇺 RUScore: 225

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

CVE-2021-34473 P0

🕵️ MuddyWater🇮🇷 IRScore: 225

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2023-46805 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 225

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

CVE-2022-40684 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 225

Fortinet Multiple Products Authentication Bypass Vulnerability

CVE-2021-34523 P0

🕵️ MuddyWater🇮🇷 IRScore: 225

Microsoft Exchange Server Privilege Escalation Vulnerability

CVE-2023-42793 P0

🕵️ APT29🇷🇺 RUScore: 225

JetBrains TeamCity Authentication Bypass Vulnerability

CVE-2023-34362 P0

🕵️ Cl0p🌐 ??Score: 225

Progress MOVEit Transfer SQL Injection Vulnerability

CVE-2021-31207 P0

🕵️ BlackCat🌐 ??Score: 225

Microsoft Exchange Server Security Feature Bypass Vulnerability

CVE-2021-34527 P0

🕵️ APT28🇷🇺 RUScore: 225

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

CVE-2023-29357 P0

🕵️ APT29🇷🇺 RUScore: 225

Microsoft SharePoint Server Privilege Escalation Vulnerability

CVE-2020-1472 P0

🕵️ MuddyWater🇮🇷 IRScore: 224

Microsoft Netlogon Privilege Escalation Vulnerability

CVE-2023-3519 P0

🕵️ RansomHub🌐 ??Score: 224

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CVE-2023-22515 P0

🕵️ RansomHub🌐 ??Score: 224

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CVE-2023-38831 P0

🕵️ APT28🇷🇺 RUScore: 222

RARLAB WinRAR Code Execution Vulnerability

CVE-2024-21412 P0

🕵️ Lazarus🇰🇵 KPScore: 220

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2024-1212 P0

🕵️ Sandworm🇷🇺 RUScore: 219

Progress Kemp LoadMaster OS Command Injection Vulnerability

CVE-2024-21413 P0

🕵️ APT29🇷🇺 RUScore: 219

Microsoft Outlook Improper Input Validation Vulnerability

CVE-2023-27997 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 208

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

CVE-2023-27532 P0

🕵️ Sandworm🇷🇺 RUScore: 198

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

CVE-2024-3400 P0

🕵️ RansomHub🌐 ??Score: 190

Palo Alto Networks PAN-OS Command Injection Vulnerability

CVE-2022-29464 P0

🕵️ MuddyWater🇮🇷 IRScore: 190

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

CVE-2021-26855 P0

🕵️ APT29🇷🇺 RUScore: 190

Microsoft Exchange Server Remote Code Execution Vulnerability

🎯 Attaques APT / espionnage (flux RSS)

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers

📅 14 July 2026📰 SecurityWeek

Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks. The post US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastruct

Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

📅 14 July 2026📰 TheHackerNews

xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publ

L'écosystème