What CISA’s own ransomware advisories name

What this counts, and what it does not

Every figure on this page is a statement about CISA’s documents. How any ransomware family actually gains access, how often vulnerabilities are exploited, and anything about victims. None of those is in this dataset.

• This is a count of what CISA's documents name. An advisory that names no CVE is not evidence that the ransomware family exploits no vulnerability. AA23-075A (LockBit 3.0) names no CVE while telling readers to 'prioritize remediating known exploited vulnerabilities'.
• AA23-325A is the clearest warning against misreading this dataset. It lists no Initial Access technique at all, yet it is specifically about exploitation of Citrix Bleed (CVE-2023-4966), which is named in its own title.
• AA24-242A's T1110.003 row reads 'RansomHub affiliates may use password spraying to obtain initial access' - CISA's own words - yet the row is printed under Credential Access. The prose and the coding disagree inside one cell of one advisory.
• n = 25. This is a census of a named series, not a sample, so there is no sampling error; but it is a small corpus, one advisory is four percentage points, and every cell has to be right. Each row carries its source URL, retrieval timestamp and the sha256 of the exact page parsed so any cell can be checked.
• Percentages on the per-year cuts are suppressed. No year has more than eleven advisories (2022: 6, 2023: 11, 2024: 4, 2025: 3, 2026: 1 to date), so those cuts are reported as counts and no percentage is given on them.
• These are living documents. Advisories carry version histories, and revisions are made inside table cells as well. Everything here is the versions retrieved on 2026-09-29; the counts can move when CISA revises an advisory.
• AA22-249A (Vice Society) is published at two URLs, /aa22-249a and /aa22-249a-0, with the same title, the same date, the same two CVEs and the same technique IDs. Counted once. A naive title match over every advisory URL returns 26 URLs for 25 advisories.
• The prefix test is applied case-insensitively as a defensive measure, because CISA's hashtag casing is not guaranteed across a series published over four years. It makes no difference to this population: all 26 strict-prefix pages carry the exact string '#StopRansomware:', so a case-sensitive test returns the same 26 URLs and the same 25 advisories.
• AA23-325A writes 'CVE 2023-4966' with a space in its own title, and AA23-040A writes 'CVE 2021-44228'. The extraction is hyphen-tolerant. Across all 178 advisory pages fetched, 11 contain an unhyphenated rendering; in none of them does it change the CVE set, because the same identifier also appears hyphenated elsewhere on the page. The tolerant pattern is correct practice but it rescued nothing here.
• CVEs are counted from the visible text, not from the markup. AA23-325A links to Citrix's own security bulletin, and that link's URL and title both carry CVE-2023-4967 - an identifier that appears nowhere in CISA's visible prose. A scan of the raw HTML would credit CISA with naming it. This is the only advisory in the series where the two rules differ, and it does not change the headline either way.
• Six advisories publish no version-history block at all. Their revision count is NULL, not zero: the series does not say whether they were never revised or whether the block is simply absent. Fifteen advisories show a 'Last Revised' date in the page header, and one of those - AA23-352A - carries no block, so revision counts are a floor.
• AA23-040A is in the series by the title rule but is not a per-family advisory: it describes state-sponsored activity funded by ransomware. 'Ransomware families' therefore describes 24 of the 25; the correct noun for the population is 'advisories'.
• Advisories cite five different MITRE ATT&CK framework versions (v12, v15, v16, v17, v19). Technique IDs and tactic placement can move between versions, so a technique coded under Initial Access in one advisory is not automatically the same coding as in another.
• Two advisories print, in their Initial Access tables, techniques ATT&CK assigns elsewhere: AA23-061A lists T1021.001 (Lateral Movement in ATT&CK) and AA23-352A lists T1059.001 (Execution). They are counted exactly as CISA printed them and listed separately, not silently corrected or dropped.
• AA25-071A puts the TACTIC id TA0001 in the ID column of its Initial Access table. It is not a technique id and is not counted as one.
• All 48 distinct CVEs named by the series are in CISA's KEV catalogue and all 48 are flagged knownRansomwareCampaignUse 'Known', against a catalogue base rate of 361 of 1,728 (20.9%). CISA maintains both the advisories and the flag, so this is internal consistency, not independent corroboration.
• CISA runs three StopRansomware listings and no two of them hold the same set. The maintained index at /stopransomware/official-alerts-statements-cisa links 38 advisories, 18 of them in the series. A second listing at /stopransomware/stopransomware runs newest first, and its newest entry is the Black Basta advisory of 10 May 2024 (AA24-131A), whose headline it prints as '#STOPRANSOMARE: BLACK BASTA'. A third sits at /stopransomware/alerts. None of them claims to cover the whole series, which is why the population was built from the sitemap and each advisory's own title, never from an index label.
• The reported ATT&CK coding is one machine-structural pass reconciled against one hand-coded pass, plus a third-method re-derivation and a cross-check against a separately written implementation that agreed on 24 of 25. It is not two blind human passes, and is not described as one.
• We found no prior published count of this series, and no machine-readable publication of CISA's AA-numbered advisories: CISA publishes CSAF for its ICS series only. That is a negative search result, not proof that no such count exists, and no claim of being first is made anywhere in this study.
• Three advisories - AA23-319A, AA23-352A and AA24-131A - link a superseded PDF revision alongside the current one. The companion PDF is taken to be the newest advisory-specific PDF the page links, dated by the /YYYY-MM/ segment of its own URL, which on all three is also the file CISA lists first. Read that way the HTML and companion-PDF bases give the same count. Read the superseded revisions as well and one advisory moves: AA23-319A's withdrawn November 2023 file names CVE-2020-1472, which neither its current PDF nor its HTML does.
• No individual is named in the dataset, in any finding or in any figure. Prior work cited on this page is credited to the organisation or project that published it, which is what the ODbL and CC BY licences on that work require.
• No leak-site data, no dark-web source, no victim organisation and no personal data was used or is published. Every fact comes from CISA's own published documents.

Census of the 25 advisories in CISA's #StopRansomware series, read from cisa.gov on 2026-09-29. Counts describe those documents on that date.

What was counted

Every cybersecurity advisory CISA publishes whose own title begins '#StopRansomware:' - 25 advisories, from AA22-181A (MedusaLocker, first published 30 June 2022) to AA26-222A (Gunra, 10 August 2026). For each one: the CVEs it names, the ATT&CK Initial Access techniques it lists, whether it publishes a version history, and whether CISA's own curated StopRansomware index links it.

Scroll the table sideways to see every column →

Every cybersecurity advisory published by CISA whose own title begins '#StopRansomware:', case-insensitively - CISA's branded ransomware advisory series, co-sealed with the FBI and usually others, and per-family in 24 of its 25 advisories. Judged on the advisory's own <h1> and <title>, never on an index label.

Eleven of the twenty-five name no CVE on the page as served

11 of the 25 #StopRansomware advisory pages, as published on cisa.gov on 2026-09-29, name no CVE identifier anywhere in the body text - 44.0% of the series. Reading each advisory's current companion PDF as well does not change that: the same 11 name none there either. The remaining 14 name 64 CVE mentions between them, 48 distinct identifiers, from none to eleven per advisory.

This is a count of what CISA's documents name. An advisory that names no CVE is not evidence that the ransomware family exploits no vulnerability.

Both published bases give the same figure. Eleven of the twenty-five advisories name no CVE on the page CISA serves, and the same eleven name none in their current companion PDF either. The figure only moves if superseded PDF revisions are read as well, which is a third and differently labelled basis: on that reading it is ten of twenty-five, because AA23-319A's withdrawn November 2023 file names CVE-2020-1472. Any figure taken from this study should name the artefact it was counted from.

Every CVE the series names is in CISA's KEV catalogue

All 48 distinct CVEs named across the series appear in CISA's Known Exploited Vulnerabilities catalogue (catalogVersion 2026.09.27, 1,728 entries), and all 48 carry knownRansomwareCampaignUse = 'Known'. The catalogue-wide rate for that flag is 361 of 1,728, 20.9%.

CISA maintains both the advisories and the KEV flag. Read this as internal consistency between two CISA products, not as independent corroboration.

Scroll the table sideways to see every column →

KEV catalogVersion 2026.09.27, 1,728 entries, published under a CC0 1.0 dedication. This is one catalogue version read on one day, not a measure of how the flag changes over time. The catalogue’s declared count matched its array length, and the join asserted that the number of matched identifiers equalled the number of distinct identifiers named.

What the advisories list under Initial Access

On the whole-document rule, the 25 advisories print 62 advisory-technique pairs under Initial Access, with 2 of 25 listing none. On the tables-only rule the totals are 59 pairs and 3 of 25 listing none. The two rules differ on exactly one advisory, AA23-040A, and no figure here should be quoted without naming its rule. T1190 Exploit Public-Facing Application is the identifier most advisories list under Initial Access: 17 of 25 on the whole-document rule, 16 of 25 on the tables-only rule. T1133 External Remote Services follows at 13 and 12 of 25, and the T1566 Phishing family stands at 13 of 25 on both rules.

These are counts of what each advisory's ATT&CK section prints. They are not a measure of how any ransomware family gains access.

Scroll the table sideways to see every column →

The coding is one machine-structural pass reconciled against one hand-coded pass, re-derived a third way and cross-checked against a separately written implementation, which agreed on 24 of 25 advisories (96%); two separately written implementations; the single difference is the AA23-040A coding rule, not an error on either side. It is not two blind human passes and is not described as one. The advisories also cite five different ATT&CK framework versions (v12, v15, v16, v17, v19), so a technique coded under Initial Access in one advisory is not automatically the same coding as in another.

The ATT&CK tables do not use one layout across the series

Across the series the advisories use 3 different table conventions (L1, L2, L4), 2 advisories use two of them in one document, and 1 advisory (AA23-040A) publishes no ATT&CK table at all. A pattern written for one convention does not find the others, which is why the technique coding was reconciled between a machine-structural pass and a hand-coded pass rather than taken from a single scrape.

Scroll the table sideways to see every column →

L0 is not a table convention: it is the one advisory that prints no ATT&CK table and cites technique identifiers inline in prose. L3 is a convention the coding scheme defines but no advisory in this series uses.

Nineteen of the twenty-five publish a version-history block; six publish none

19 of the 25 advisories publish a version-history or revisions block; 6 publish none and are recorded NULL, not zero - the series does not say whether they were never revised or whether the block is simply absent. Among the 19 that publish one, the entry count runs from 1 to 6 (AA23-061A, BlackSuit/Royal). The heading is written 'Revisions' on 2022 advisories and 'Version History', in mixed or upper case, from 2023 onwards, and entries appear in both orders.

Scroll the table sideways to see every column →

The 6 publishing no block are AA23-040A, AA23-075A, AA23-158A, AA23-284A, AA23-352A, AA24-242A. Among the 19 that publish one, entries run from 1 to 6, median 1. The heading changes wording across the series: Revisions (2022 advisories, 6), then Version History (2023 onwards, 9), then VERSION HISTORY in block capitals (2023 onwards, 4).

Seven of the twenty-five are not linked from CISA's curated StopRansomware index

18 of the 25 advisories in the series appear in CISA's curated StopRansomware index; 7 do not - every 2022 advisory in the series plus AA23-040A. The index carries 38 advisory links in total, 20 of which are not part of the branded series at all, reaching back to AA18-337A (SamSam) and AA19-339A (Dridex).

Scroll the table sideways to see every column →

The index does not claim to cover the series - it describes itself as 'official CISA updates' - and it cannot be used as the population frame. CISA runs three StopRansomware listings and no two of them hold the same set: this one, a second at /stopransomware/stopransomware whose newest entry is the Black Basta advisory of 10 May 2024 and which prints that headline as '#STOPRANSOMARE: BLACK BASTA', and a third at /stopransomware/alerts.

Advisories by year of first publication

The series starts on 30 June 2022 and the annual counts are small and vary: six advisories in 2022, eleven in 2023, four in 2024, three in 2025 and one so far in 2026. No annual cut has a denominator above eleven, so they are reported as counts and no percentage is given on them.

Scroll the table sideways to see every column →

Counts only. The largest annual denominator is 11, so no percentage is given on these cuts. The year is the date the advisory was first published, not the date of any later revision.

All 25 advisories, one row each

Scroll the table sideways to see every column →

CVE counts are taken from the visible text of the HTML page as served on 29 September 2026, with markup stripped first, so an identifier carried only inside a link’s address is not credited to CISA. Downloads: CSV · README and attribution · JSON.

How the census was built

CISA publishes no explicit public-domain notice. The position rests on the statute and on CISA's TLP:CLEAR default, so this study does not say that CISA declares its own content public domain. CISA's own rules prohibit use of the DHS seal or CISA logo in any way implying endorsement. Neither is reproduced. Each advisory's own non-endorsement wording is stored per advisory and travels with any quotation from it. 23 of the 25 advisories publish a non-endorsement clause of their own, in 19 distinct wordings, and each is stored against its advisory in the dataset.

Four disagreements, three resolved and one left open

Two collection streams built this census, and the record of where they disagreed — and where the study's own brief disagreed with its retrieval timestamps — is published rather than dropped. Rather than publish the winner and drop the rest, each disagreement is recorded with its cause and its outcome.

Scroll the table sideways to see every column →

• How many advisories publish a version-history block: Re-derived here from the stored HTML. The heading is written <h2><strong>Version History</strong></h2>, so a pattern that matches the heading tag's inner HTML rather than its stripped text misses it. AA22-181A, for example, publishes 'June 30, 2022: Initial Version' under an h3 'Revisions'. The published figure is 19 publishing a block and 6 not.
• How to code ATT&CK Initial Access for AA23-040A: Not resolved, and deliberately so. AA23-040A publishes no ATT&CK table but names T1190, T1133 and T1195 in prose under a sub-heading it has itself tagged TA0001 (Initial Access). Rule A counts tables only; rule B counts what the document names anywhere. The two coding streams chose differently and agree on the other 24 of 25. Both are published, in the JSON and as separate CSV columns. Any prose must name the rule it uses and must not mix them.
• Which PDF counts as an advisory's companion PDF: Three advisories - AA23-319A, AA23-352A and AA24-131A - link a superseded PDF revision alongside the current one, and an earlier draft of this analysis read whichever file it had stored first. On AA23-319A that was the November 2023 file, which names CVE-2020-1472; the April 2025 revision CISA now serves names no CVE at all. The rule is now stated and applied: the companion PDF is the newest advisory-specific PDF the page links, dated by the /YYYY-MM/ segment of its own URL, which on all three advisories is also the file CISA lists first. On that rule the HTML and companion-PDF bases agree exactly, at 11 of 25. The superseded-PDF reading is kept as a third, separately labelled basis rather than dropped.
• The collection date: Every retrieval timestamp in every manifest records 29 September 2026. The study dates its collection from those timestamps.

What already exists, and what this adds

We found no prior published count of what CISA's own #StopRansomware advisory series names. CISA publishes CSAF machine-readable output for its ICS advisory series only. The AA-numbered advisories are prose - HTML and PDF and we found no equivalent machine-readable publication of them. Four search framings found no existing count of the series. That is a negative search result. A negative search result is not proof that no such count exists, and no claim to be first is made here or anywhere else in this study.

Scroll the table sideways to see every column →

The closest prior work in shape: ENISA's Threat Landscape for Ransomware Attacks (2022), which could not establish an initial-access route for 594 of the 623 incidents it studied - 95.3%. That is the closest work in shape: a public body counting what the record does not say. It counted third-party incident reports; we count one publisher's own document series, document by document.

How this differs from our ransomware and backup page

We also keep a page on ransomware and backup targeting. That page collects figures other organisations have published about ransomware incidents: victim surveys, vendor telemetry and recovery rates. This page counts something much narrower — the contents of a fixed set of documents. It reports which CVEs CISA’s own #StopRansomware advisories name. It does not report how often ransomware exploits a vulnerability, and no figure here should be read that way.

Building this census also made us re-check that page. Three figures it carried have been deleted rather than restated: two 2024 backup-targeting percentages that had reached it through a third-party summary of a vendor report instead of the report itself, and a root-cause percentage from an earlier edition of a vendor survey, presented alongside a conditional compromise rate quoted without its condition. None could be checked against the publisher’s own document. The census figure now sits on that page in their place, with its basis attached.

Questions

Related pages on Servnet

Background reading: what patch management involves and ransomware protection. The nearest study of ours in shape, counting CVEs rather than advisories, is our count of the security fixes Windows 10 machines stop receiving. · For reported incidents rather than advisories, see our count of personal data breach reports to the ICO. · More Servnet research