← Back to blog

Darkhotel Has Not Exploited a Single Critical Vulnerability. Other Attacker Groups Exploit Nothing Else.

·Bastien Cacace
threat-intelligencecvssexploitationmitre-attackprioritizationcybersecurity

CVE-2023-20867, affecting VMware Tools, carries a CVSS score of 3.9/10. That is the score you give a flaw you have decided is not worth losing sleep over. The exploitation conditions explain why: you already need to be on the machine, with elevated privileges, and the attack is difficult.

And yet this is the flaw used by the espionage group UNC3886, as documented by Mandiant, then by the Fire Ant cluster analysed by Sygnia two years later. CISA added it to its Known Exploited Vulnerabilities catalog (KEV). From a compromised ESXi hypervisor, it lets you run commands inside every guest virtual machine with no authentication at all, and without leaving a trace on the guest side. Not bad!

The CVSS score is not wrong. It simply answers a different question from the one we ask of it.

What we looked at

We ingested threat intelligence reports (vendor research, government advisories, incident write-ups) published between June 2015 and early September 2026, 94% of them since 2022, and extracted one precise relation: this named actor exploited this CVE. As of today that comes to 598 CVEs linked to 461 named entities: 277 actors and 184 tools, 93 of them resolved to the MITRE ATT&CK reference.

SYRN's Threat Actors & Tools panel: actors ranked by article count, most of them with their MITRE ATT&CK identifier, their alias count and their article count, filterable down to entities resolved to ATT&CK.
The inventory of named entities. The alias counts show why reconciliation is the hard part: APT28 appears under 20 spellings, Mustang Panda under 19.

This is the corpus we crossed with CVSS scores. Not to settle whether CVSS is "good", but to answer a simple question: when an attacker group picks a flaw, does it always pick a critical one?

The CVSS score used is the one SYRN displays, whatever its origin1. 595 of the 598 CVEs carry one.

Yes, attributed flaws are more critical than average

Let us start with what proves CVSS right (no great surprise). CVEs used by named groups are markedly more critical than the rest:

CVEs attributed to a group All CVEs
Critical (CVSS ≥ 9) 42.9% 12.5%
High (7 to 9) 44.2% 36.4%
Medium (4 to 7) 12.6% 46.9%
Low (< 4) 0.3% 4.2%
Sample 595 366,628

Figures as of 6 September 2026.

A flaw exploited by an identified group is 3.4 times more likely to be rated critical than a CVE picked at random. Attackers are not fools either. Might as well go for whatever is easiest to exploit.

But half of them are not

Now turn the table around. 57.1% of the CVEs attributed to a named attacker group are not rated critical in CVSS terms (340 out of 595). And 77 of them fall below 7, that is, below the threshold where most remediation policies start counting days, or else ignore the CVE altogether.

This is not a legacy of the past either: restricting the count to CVEs published in 2024 and 2025, 60.1% of the 148 attributed CVEs are still not critical under CVSS.

A few of these "medium" flaws:

CVE CVSS Attributed to
CVE-2021-31207 (ProxyShell) 6.6 AvosLocker, BianLian, BlackByte, BlackCat, FIN7, Hive, APT40... 13 groups
CVE-2021-1879 (WebKit) 6.1 APT29
CVE-2024-20399 (Cisco NX-OS) 6.0 Velvet Ant
CVE-2024-50302 (Linux kernel / Android) 5.5 Cellebrite
CVE-2023-41991 (Apple) 5.5 Intellexa / Predator
CVE-2023-24055 (KeePass) 5.5 ViperSoftX
CVE-2023-20867 (VMware Tools) 3.9 UNC3886, Fire Ant

Thirteen ransomware and espionage groups shared a flaw rated 6.6.

It depends entirely on the group

0 critical for Darkhotel. 100% for Qilin affiliates.

This is where the numbers get interesting. Compute, for each group, the share of its CVEs rated critical, and you do not get an average hovering around 50%. You get the full range:

Share of critical CVEs (CVSS 9 or above) by attacker group: 0% for Purple Fox, Darkhotel and Scarlet Mimic, 8% for APT28, 56% for HAFNIUM, 60% for CL0P, 67% for Volt Typhoon and Ember Bear, 89% for PROPHET SPIDER, 100% for Qilin affiliates.
Each group has a stable severity profile. It does not track how dangerous the group is, but how it gets in.

None of Purple Fox's 10 CVEs, Darkhotel's 8 or Scarlet Mimic's 6 is critical under CVSS. APT28 sits at 8%, with a median CVSS of 7.8. UNC3886 averages 6.2. Ember Bear, the cyber arm of the GRU's Unit 29155, sits in the middle at 67%.

Others go for the efficient route. Qilin affiliates are at 100%, PROPHET SPIDER at 89%. All their CVEs, or very nearly, are rated 9 or above. Those ones are in a hurry.

So two groups equally capable of wrecking your infrastructure sit in two CVSS bands that do not overlap.

Why: CVSS 9 and above describes a shape of attack

The explanation is not mysterious, it is arithmetic. Here is the vector of the attributed CVEs, by band:

CVSS ≥ 9 CVSS < 9
Network attackable (AV:N) 252 / 255 199 / 340
No authentication (PR:N) 243 / 255 189 / 340
No user interaction 251 / 255 216 / 340

99% of attributed critical CVEs are remotely attackable, and 95% need no credential at all. That is no coincidence: it is the CVSS formula. To reach 9.8 you have to stack AV:N/AC:L/PR:N/UI:N and total impact. A flaw that requires a foothold in the system is structurally capped below 9.

Put another way, "CVSS 9 or above" is almost a synonym for "unauthenticated RCE, exploitable at scale". That is exactly what you need if you scan the internet, run a botnet or work as a ransomware affiliate. Those actors have no reason to care about anything else.

But a group that gets in through phishing, a stolen credential or malware in the supply chain does not have that problem: it is already inside. What it needs is the next step, such as privilege escalation, sandbox escape or authentication bypass. Things a medium or high scoring flaw can deliver. Among the CVEs below 9 you will find 126 flaws with a local vector and 115 that require user interaction.

How to do better

At SYRN, our own score does not escape the problem: 69 of the 598 attributed CVEs are not rated critical by SYRN. None of them is in KEV, and only five carry an exploitation signal from our other sources, including telemetry that covers CVEs going back to 1999. So this is not a calendar effect: those 69 CVEs spread from 2009 to 2026. When an exploited flaw is only ever cited in a single report, the information tends to get lost.

The way forward is not to add attribution to the score as a boolean, but to weight it by the quality of its source. Hence the two levels attached to every relation:

  • confirmed: the relation comes from the public or private entities that did the analysis, such as Mandiant, Unit 42, Talos, Kaspersky, ESET, Volexity, CrowdStrike, Citizen Lab, the DFIR Report or a CERT (CISA, FBI IC3, CERT-FR).
  • reported: everything else, including the trade press, which relays very well but does not observe, such as The Hacker News, BleepingComputer, SecurityWeek or The Record.

The gap is measurable: 91.9% of the CVEs carrying at least one confirmed relation are considered exploited by SYRN, against 77.8% for those carrying only reported.

SYRN's Threat Attribution table: each row ties a CVE to one or more actors or tools, with their MITRE ATT&CK identifier and the date of the latest report.
The corpus as you consult it, filtered here down to entities resolved to ATT&CK: a CVE, the entities tied to it, and the date of the most recent report asserting it.

These 598 attributed CVEs can be browsed in SYRN with their evidence level, their source and the original excerpt.

Footnotes

  1. A CVE often carries several CVSS scores, the CNA's (the vendor or entity that publishes the flaw) and the NIST's, which sometimes diverge. SYRN keeps the first available in the order CNA, Vulnrichment (CISA's enrichment), then NIST. ↩