1000 Business Worldwide Were Hit By Kaseya Supply-Chain Attack With REvil Ransomware

Researchers have discovered that the Russia-linked REvil ransomware gang first targets the Florida-based IT company “Kaseya” and then spread through corporate networks that use its software. According to researchers, more than 1000 business were hit by Kaseya supply-chain attack until now.

The company’s CEO Fred Voccola quoted, “Beginning around mid-day (EST/US) on Friday, July 2, 2021, Kaseya’s Incident Response team learned of a potential security incident involving our VSA software”. In a statement shared late Friday. In response to the attack, The company has shut down its SaaS servers as a precautionary measure. In addition to that, the company notified their customers to shut down their on-premises VSA servers to prevent them from being compromised.

Update: Now, almost ten days later, on 11th July, Kaseys has released a patch for VSA supply-chain attack. The Florida-based software company has fixed three new security vulnerabilities in the released patch to address critical security issues in its Virtual System Administrator (VSA) solution. With this update, the company has fixed a total of seven vulnerabilities, including the three new vulnerabilities. Let’s see the changes Kaseya has made in the VSA release 9.5.7a.

Voccola also said that it had identified the source of the Kaseya supply-chain attack. And it is creating a patch to mitigate the ongoing issues.

Mark Loman, a Malware Analyst from Sophos Tweated, The Kaseya supply-chain attack seems to stem from a malicious Kaseya update. According to him, the attack used Kaseya VSA to deploy a variant of the REvil ransomware into a victim’s environment. He also added that the supply-chain attack attempts to disable Microsoft Defender Real-Time Monitoring via PowerShell.

Picture #1: A tweet from Mark Loman,on Kaseya supply-chain attack

Victims Of Kaseya Supply-Chain Attack:

Initially, Researchers from Huntress Labs found eight managed service providers (MSPs) had been hit by the attack. About 200 businesses that took the IT services from those eight MSPs have been locked out of parts of their network. Recent studies from the Dutch Institute for Vulnerability Disclosure (DIVD) show that REvil ransomware might have used a number of zero-day vulnerabilities in its VSA software (CVE-2021-30116) to exploit and deploy the ransomware. DIVD also said that these zero-days are trivial to exploit, and about 1000 businesses from more than 17 countries, including the U.K., South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand, and Kenya, were affected by the attack.

Picture #2: Kaseya Supply-Chain Attack stats from DIVD

Current Updates Of Kaseya Supply-Chain Attack:

We recommend visiting these two pages regularly to have updated information about the Kaseya supply-chain attack.

Updates from Huntress Incident Response team: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

Latest updates from Kaseya: https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021

What To Do If You Are Hit by Kaseya supply-chain Attack?

Recommendations for all:

Recommendations for MSPs:

Recommendations for MSP’s customers:

Indicators Of Compromise (IOCs):

Sophos Detections

Process Data:

Files Involved

Registry Keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BlackLivesMatter

Ransomware Extension:

<victim ID>-readme.txt

File Hashes:

36a71c6ac77db619e18f701be47d79306459ff1550b0c92da47b8c46e2ec075233bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

Domains 

Thanks for reading this threat post. We believe it’s our duty to share information about the threats to create awareness and secure the digital world.