The vulnerability half is solid. CISA marks every KEV entry with whether it is known to have been used in ransomware campaigns. That is a maintained government determination, not an inference, and it is the most defensible answer available to “what should we patch first against ransomware”.
But “Unknown” does not mean safe. It means CISA has not confirmed ransomware use — often because attribution has not caught up, not because the flaw is unattractive. Treating the unflagged remainder of KEV as lower risk is the single most likely way to misuse this screen. Everything in KEV is being exploited.
The intel half is attacker claims. Leak-site posts are published by the criminals themselves. They are sometimes false, sometimes recycled from older breaches, sometimes a pressure tactic against a victim who has not paid, and occasionally a different group reposting someone else’s work. A name appearing here is a claim, not a confirmed breach, and this tool never calls it one.
Counts measure posting, not attacks. A group that goes quiet may have been disrupted, rebranded, moved to private extortion, or simply stopped updating its site. Volume here tracks how loudly a group publicises itself, which is not the same as how much damage it is doing.
knownRansomwareCampaignUse: Known. Sort by any column.