Kaseya supply chain attack hit nearly 40 service providers with REvil ransomware

[ad_1]

The threat actors behind the REvil ransomware ring appear to have pushed the ransomware via an update to Kaseya’s IT management software, infecting nearly 40 customers worldwide, in case a supply chain ransomware attack spreads.

“Beginning around midday (EST/US time) on Friday, July 2, 2021, Kaseya Incident Response Team became aware of a potential security incident related to the VSA program,” said company CEO Fred Fukulla in a statement shared late Friday. our own.”

After the incident, the IT and security management services company said it had taken immediate steps to shut down our SaaS servers as a precaution, as well as notifying its local customers to shut down their VSA servers to prevent them from being hacked.

Fokola also said the company has identified the source of the vulnerability and is preparing a patch to mitigate ongoing issues. In the meantime, the company also indicated that it intends to keep all VSA on-premises, SaaS, and VSA-hosted servers closed until it is safe to resume operations.

According to Sophos Malware Analyst Mark Loman, the industry-wide supply chain attack is taking advantage of Kaseya VSA to spread a variant of REvil ransomware into the victim’s environment, with the REvil binary side loading via a fake Windows Defender application to encrypt the victim’s files.

Loman added that the attack chain also includes attempts to disable real-time monitoring of Microsoft Defender via PowerShell. In a Reddit post detailing how the breach works, Huntress Labs said the Trojan is distributed in the form of “Kaseya VSA Agent Hot-fix”.

The researchers note that they found eight Managed Service Providers (MSPs), companies that provide IT services to other companies, affected by the attack. Huntress Labs said about 200 companies served by MSPs have been blocked from parts of its network.

As the ransomware crisis continues to escalate, MSPs have emerged as a profitable target, mainly because a successful hack opens access to multiple clients, leaving them all vulnerable at once.

.

[ad_2]