REvil ransomware attacks systems using remote IT management software from Kaseya

[ad_1]

Just in time to spoil the weekend, ransomware attackers apparently used Kaseya — a software platform designed to help manage IT services remotely — to deliver their payload. Sophos administrator and ethical hacker Mark Loman tweeted about the attack earlier today, and is now reporting that affected systems will require $44,999 to unlock it. A note on Kaseya’s website asks customers to shut down their VSA servers for now “because one of the first things an attacker does is to turn off administrative access to VSA.”

News Flash: Cybercriminals are $$ holes.

Keep in mind all the Incident Response Teams this weekend because they are in the midst of it…again.

If you are using Kaseya VSA, shut it down *now* until you are asked to reactivate and start IR. Here’s the duo: https://t.co/NIuGJZW84p https://t.co/GSXPlOPjFt

– Chris Krebs (@C_C_Krebs) July 2, 2021

According to a report by Bleeping Computer, the attack targeted six large MSPs and encrypted data for up to 200 companies.

At DoublePulsar, Kevin Beaumont posted more details of how the attack worked, with REvil ransomware arriving via Kaseya update and using platform administrative privileges to infect systems. Once managed service providers are infected, their systems can attack clients that provide remote IT services for (network management, system updates and backups, among other things).

In a statement, Kassiya told The Verge: “We are investigating a potential attack against VSA that indicates it was limited to only a small number of our local customers.” Notice claims that all of its cloud servers are now in “maintenance mode,” a move the spokesperson said was taken out of “excessive caution.”

We are investigating a potential attack against VSA that it indicates was limited to only a small number of our local customers. We have proactively shut down our SaaS servers out of great caution.

We are investigating the root cause of the accident with the utmost vigilance, and we have:

a. Notify all of our corporate premises customers to shut down their VSA servers immediately

B. Turn off our SaaS servers

We have been notified by a few security companies of the issue and we are working closely with them as well. As we continue to investigate the incident, we will update our customers (and interested parties) as we have more information.

Dana Lidholm – Senior Vice President, Corporate Communications

Today’s attack has been linked to the infamous REvil ransomware gang (already linked to attacks on Acer and meat supplier JBS earlier this year), and The Record notes that by grouping incidents under more than one name, this may be the third time it has been used. Kaseya’s program was destined for their exploits.

[ad_2]