A tsunami of a new type of ransomware hit hundreds of companies

[ad_1]

Perhaps inevitable today’s dominant cybersecurity threat – supply chain attacks and ransomware – will combine to wreak havoc. That’s exactly what happened on Friday afternoon, as the notorious REvil criminal group successfully encrypted hundreds of companies’ files in one fell swoop, apparently thanks to a hacked IT management program. And this is only the beginning.

The situation is still developing and some details – and most importantly, how the attackers infiltrated the software in the first place – are still unknown. But the impact was already severe and would only get worse given the nature of the targets. The software in question, Kaseya VSA, is very popular among so-called managed service providers, who provide IT infrastructure to companies that prefer to outsource this kind of thing rather than run it themselves. Which means if you succeed in hacking MSP, you will suddenly be able to reach their customers. It’s the difference between breaking the safe deposit boxes one by one and stealing the skeleton key of the bank manager.

So far, according to security company Huntress, REvil has hacked eight MSPs. The three Huntress works with have direct accounts for 200 companies whose data was found encrypted on Friday. It doesn’t take much extrapolation to see how bad it can be from there, especially considering Kaseya is so ubiquitous.

“Kaseya is Coca-Cola for remote management,” says Jake Williams, chief technology officer of incident response firm BreachQuest. “Because it’s the weekend, we won’t even know the number of casualties there until Tuesday or Wednesday next week. But it’s massive.”

The worst of both worlds

MSPs have always been a popular target, particularly for nation-state hackers. Hitting them is a wonderfully effective way to spy, if you can manage it. As the 2018 Justice Department indictment showed, elite Chinese APT10 spies used MSP settlements to steal hundreds of gigabytes of data from dozens of companies. REvil has targeted service providers before, too, using its foothold in a third-party IT company to hijack 22 Texas municipalities at once in 2019.

Supply chain attacks are also becoming increasingly common, most notably in last year’s devastating SolarWinds campaign that gave Russia access to several US agencies and countless other victims. Like MSP attacks, supply chain breaches also have a ripple effect; Smearing a single software update can result in hundreds of casualties.

You can start to see why a supply chain attack targeting MSPs could potentially have exponential consequences. Throw system-disrupting ransomware into the mix, and the situation will become much more difficult. It brings to mind the devastating NotPetya attack, which also used a supply chain compromise to spread what initially looked like ransomware but was in fact a nation-state attack perpetrated by Russia. A more modern Russian campaign also comes to mind.

“This is SolarWinds, but with ransomware,” says Brett Kalou, threat analyst at antivirus company Emsisoft. “When a single MSP is hacked, it can affect hundreds of end users. In this case, it appears that many MSPs have been hacked, so…”

BreachQuest’s Williams says that REvil appears to be asking the victim companies for roughly $45,000 in Monero cryptocurrency. If they fail to pay within a week, the demand doubles. Security news site BleepingComputer reports that REvil has asked some victims $5 million for a decryption key that unlocks “all of your network’s encrypted computers,” which may be specifically directed to ISPs rather than their customers.

“We often talk about MSPs being the mother ship of many small to medium businesses and organizations,” says John Hammond, Huntress’s chief security researcher. “But if it was Kaseya who got hit, then the bad actors would have caused all the mother ships to be hacked.”

.

[ad_2]