FactualRisk — 🌍 Géopolitique & Threat Actors

Pays attaquants

Threat Actors connus

Acteurs observés

CVEs attribués

🌍 Pays d'origine identifiés

🇷🇺 RU26 CVE(s)

🌐 ??19 CVE(s)

🇨🇳 CN19 CVE(s)

🇰🇵 KP9 CVE(s)

🇮🇷 IR4 CVE(s)

🕵️ Threat Actors (base + observés)

🇷🇺 APT29observé11 CVE(s)

🇷🇺 APT28observé9 CVE(s)

🇰🇵 Lazarusobservé9 CVE(s)

🇨🇳 Volt Typhoonobservé9 CVE(s)

🌐 Cl0pobservé7 CVE(s)

🇨🇳 APT41observé6 CVE(s)

🇷🇺 Sandwormobservé6 CVE(s)

🌐 RansomHubobservé5 CVE(s)

🇨🇳 Salt Typhoonobservé4 CVE(s)

🇮🇷 MuddyWaterobservé4 CVE(s)

🌐 Akiraobservé3 CVE(s)

🌐 LockBitobservé2 CVE(s)

🌐 BlackCatobservé2 CVE(s)

CVEs avec attribution géopolitique

CVE-2024-1212 P0

🕵️ Sandworm🇷🇺 RUScore: 283

Progress Kemp LoadMaster OS Command Injection Vulnerability

CVE-2024-21413 P0

🕵️ APT29🇷🇺 RUScore: 280

Microsoft Outlook Improper Input Validation Vulnerability

CVE-2023-44487 P0

🕵️ Sandworm🇷🇺 RUScore: 228

HTTP/2 Rapid Reset Attack Vulnerability

CVE-2021-26084 P0

🕵️ APT41🇨🇳 CNScore: 228

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

CVE-2023-46604 P0

🕵️ RansomHub🌐 ??Score: 228

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

CVE-2021-44228 P0

🕵️ Lazarus🇰🇵 KPScore: 228

Apache Log4j2 Remote Code Execution Vulnerability

CVE-2019-19781 P0

🕵️ APT29🇷🇺 RUScore: 218

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

CVE-2022-40684 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 218

Fortinet Multiple Products Authentication Bypass Vulnerability

CVE-2024-21887 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 218

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

CVE-2023-22518 P0

🕵️ LockBit🌐 ??Score: 218

Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

CVE-2023-0669 P0

🕵️ Cl0p🌐 ??Score: 218

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

CVE-2023-46805 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 218

Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

CVE-2023-29357 P0

🕵️ APT29🇷🇺 RUScore: 218

Microsoft SharePoint Server Privilege Escalation Vulnerability

CVE-2023-4966 P0

🕵️ Akira🌐 ??Score: 218

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

CVE-2023-22515 P0

🕵️ RansomHub🌐 ??Score: 218

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

CVE-2023-34362 P0

🕵️ Cl0p🌐 ??Score: 218

Progress MOVEit Transfer SQL Injection Vulnerability

CVE-2021-34527 P0

🕵️ APT28🇷🇺 RUScore: 218

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

CVE-2021-34473 P0

🕵️ MuddyWater🇮🇷 IRScore: 218

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-34523 P0

🕵️ MuddyWater🇮🇷 IRScore: 218

Microsoft Exchange Server Privilege Escalation Vulnerability

CVE-2021-31207 P0

🕵️ BlackCat🌐 ??Score: 218

Microsoft Exchange Server Security Feature Bypass Vulnerability

CVE-2024-21412 P0

🕵️ Lazarus🇰🇵 KPScore: 218

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2023-38831 P0

🕵️ APT28🇷🇺 RUScore: 217

RARLAB WinRAR Code Execution Vulnerability

CVE-2023-3519 P0

🕵️ RansomHub🌐 ??Score: 217

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

CVE-2023-42793 P0

🕵️ APT29🇷🇺 RUScore: 216

JetBrains TeamCity Authentication Bypass Vulnerability

CVE-2023-27997 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 216

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

CVE-2023-27532 P0

🕵️ Sandworm🇷🇺 RUScore: 206

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

CVE-2021-22986 P0

🕵️ LockBit🌐 ??Score: 183

F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability

CVE-2019-3396 P0

🕵️ APT41🇨🇳 CNScore: 183

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

CVE-2021-22205 P0

🕵️ Volt Typhoon🇨🇳 CNScore: 183

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

CVE-2022-1388 P0

🕵️ Lazarus🇰🇵 KPScore: 183

F5 BIG-IP Missing Authentication Vulnerability

🎯 Attaques APT / espionnage (flux RSS)

New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks

📅 29 May 2026📰 TheHackerNews

A previously undocumented threat actor dubbed GREYVIBE has been attributed to ongoing and persistent attacks targeting Ukraine and Ukraine-related entities since at least August 2025. GREYVIBE, per W

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

📅 29 May 2026📰 TheHackerNews

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through

[remote] Microsoft - NTLMv2 Hash Capture

📅 29 May 2026📰 Exploit-DB

Microsoft - NTLMv2 Hash Capture

Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks

📅 28 May 2026📰 SecurityWeek

Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate. The post Russia-Linked ‘GreyVi