# Ransomware Exposure Monitoring URL: https://www.deepinfo.com/solutions/use-cases/ransomware-exposure-monitoring/ ## Close the Ways In. Watch the Leak Sites. Before an attack, ransomware exposure is a way in: an exploited vulnerability, exposed remote access, a login stolen from an infected device. After one, it is a name on a leak site. [External Attack Surface Management](https://www.deepinfo.com/platform/easm/), [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) and [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) watch both halves, for you and for your vendors. [Request demo](https://www.deepinfo.com/request-demo/) ### Ransomware Starts With a Way In. The ways in are rarely new, and many of them can be seen from outside. The visibility that helps an attacker choose a target also helps your team close the door first. Vulnerabilities #### Known Exploited CVEs Internet-facing software with a CVE that CISA KEV lists, some of them marked for known use in ransomware campaigns. Exposure #### Remote Access on the Internet Remote desktop, VPN and admin interfaces answering on public IP addresses, including on assets missing from the inventory. Credentials #### Logins From Infected Devices Infostealer logs carry saved VPN and SSO logins and session cookies, ready for someone to try. ### Close the Doors and Watch the Exits. The modules answer two questions: how would an extortion crew get in, and would you know if it already had? #### [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) Finds exposed services, public login pages and CVEs on your technologies, and flags products past end of life. #### [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) Ranks every CVE by CVSS, EPSS and CISA KEV, with the KEV entry’s known ransomware campaign use in the record. #### [Compromised Employee Device Monitoring](https://www.deepinfo.com/platform/cti/compromised-employee-device-monitoring/) Finds infected devices tied to your employees, with counts of the saved passwords, cookies and sensitive cookies each one held. #### [Dark Web Mentions Monitoring](https://www.deepinfo.com/platform/cti/dark-web-mentions-monitoring/) Watches the dark web index, leak sites included, for your domains and names and for those of your key vendors. #### [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) Profiles record the leaks each actor is tied to, the industries it targets and the CVEs and tools it uses. #### [Continuous Monitoring](https://www.deepinfo.com/platform/tprm/continuous-monitoring/) Scans your vendors’ surfaces as it scans yours, so a vendor’s exposed remote access or unpatched KEV-listed CVE shows up in your queue too. ### Ransomware-Linked CVEs Go First. CISA’s Known Exploited Vulnerabilities catalog records, for each listed CVE, whether it is known to have been used in ransomware campaigns. The Deepinfo Platform keeps that field in the CVE record, next to CVSS and EPSS. On your assets, that turns “which of our exploitable CVEs do ransomware crews use?” into a question the record already answers. [Vulnerability Detail reference](https://docs.deepinfo.com/reference/vulnerability/detail/) - **KEV date added**: When CISA listed the CVE as exploited - **Due date**: The remediation deadline CISA set - **Required action**: What CISA says to do about it - **Ransomware use**: Whether it is known to be used in ransomware campaigns - **EPSS**: Probability of exploitation in the next 30 days - **CVSS**: v2 to v4.0 where published, plus vDeep ### Make Readiness a Weekly Routine. 1. **Inventory** Discovery and scanning keep your external assets and the services on them current, subsidiaries included. 2. **Harden** Work KEV-listed and ransomware-linked CVEs and exposed remote access first, and verify each fix by rescan. 3. **Rotate** Reset logins and revoke sessions for employees whose devices appear in stealer logs. 4. **Watch** Keep your names and your critical vendors’ names under dark web monitoring, leak sites included. 5. **Respond** If a name appears, read the post in place, check the actor’s profile and bring in incident response and the vendor owner. ### Put Ransomware Exposure in Context. - [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/) (Use case): The full CVSS, EPSS and CISA KEV queue for your internet-facing assets. - [Credential Exposure Management](https://www.deepinfo.com/solutions/use-cases/credential-exposure-management/) (Use case): Stolen employee logins, worked to a closed state. - [Third-Party Risk Management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/) (Use case): Vendor surfaces, scanned and scored like yours. ### Use This Data in Your Tools The vulnerability data the platform prioritizes with, CVSS, EPSS and CISA KEV for every CVE, is open through the API. - [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/) - [Port Scan API](https://www.deepinfo.com/data-api/apis/port-scan/) - [Technology Lookup API](https://www.deepinfo.com/data-api/apis/technology-lookup/) ### Questions About Ransomware Exposure Monitoring **Does the platform watch ransomware leak sites?** Leak sites are one of the source types in Deepinfo’s dark web index, next to forums, markets, paste sites and chats. Mentions monitoring and search both cover them. **Can we watch for our vendors on leak sites too?** Yes. Add their names and domains to the identifiers you monitor. Their external surfaces can run as Third-Party Risk Management portfolios at the same time. **How does the platform find exposed remote access?** Port scans cover TCP and UDP on each approved asset and record the service behind each open port, so remote desktop, VPN and admin interfaces on public addresses show up as findings. **Can we be alerted when a new port opens?** Yes. A newly open port on a monitored asset is a notification event of its own, sent instantly or in an hourly, daily, weekly or monthly digest to the team members a rule names. **What does “known ransomware campaign use” mean?** It is a field in CISA’s Known Exploited Vulnerabilities catalog that records whether a listed CVE is known to have been used in ransomware campaigns. The platform stores it with each KEV-listed CVE. **Does this replace endpoint protection or backups?** No. It works outside your network, on the exposure that leads to an attack and the signals that follow one. Endpoint, backup and recovery controls stay where they are. ### See Your Ransomware Exposure From the Outside. Book a demo to review exploited CVEs, exposed services and leaked logins on your surface. [Request demo](https://www.deepinfo.com/request-demo/)