Scale, details of Kaseya’s massive attack appear

[ad_1]

BOSTON (AFP) – Cybersecurity teams worked frantically Sunday to stem the impact of the largest global ransomware attack ever recorded, with some details emerging about how the gang responsible for Russia hacked the company whose show was the channel.

A subsidiary of the notorious REvil gang, which was notorious for extorting $11 million from JBS meat processor after the Memorial Day attack, infected thousands of victims in at least 17 countries on Friday, largely through companies running remote IT infrastructure for multiple clients. , cybersecurity researchers said. They reported ransom demands of up to $5 million.

The FBI said in a statement Sunday that it was investigating the attack along with the Federal Cyber ​​Security and Infrastructure Security Agency, although “the scale of this incident may leave us unable to respond to each individual victim.”

President Joe Biden suggested on Saturday that the United States would respond if it was determined that the Kremlin was at all involved. He said he asked the intelligence community to “take a deep dive” into what happened.

The attack comes less than a month after Biden pressured Russian President Vladimir Putin to stop providing a safe haven to REvil and other ransomware gangs that the United States sees as a threat to national security.

A wide range of companies and public agencies have come under attack recently, seemingly on all continents, including in financial services, travel, entertainment and the public sector — though few are large, cybersecurity firm Sophos said. Ransomware criminals break into networks and plant malware that disables networks upon activation by shuffling all their data. Victims get the decryption key when they pay.

Swedish grocery chain Coop said most of its 800 stores would close for a second day on Sunday because their cash register software supplier was paralyzed. A Swedish pharmacy chain, a chain of gas stations, a state railway line and the SVT public broadcasting station were also bombed.

German news agency dpa reported that an unnamed information technology services company told authorities in Germany that several thousand of its customers had been put at risk. Among the reported victims are two large Dutch IT services companies – VelzArt and Hoppenbrouwer Techniek. Most ransomware victims do not publicly report attacks or disclose whether they have paid a ransom.

CEO Fred Fukola of the hacked software company, Kaseya, put the number of victims in the low thousands, mostly small businesses like “dental practices, architecture firms, plastic surgery centers, bookshops, and things like that.”

Vokula said in an interview that only 50 to 60 of the company’s 37,000 customers were at risk. But 70% were managed service providers using the company’s VSA hack to manage multiple clients. It automates software installation, security updates, backup management, and other vital tasks.

Experts say it was no coincidence that Revell launched the attack at the start of the 4th of July weekend, knowing that US offices would have few employees. Many victims may not know this until they return to work on Monday. Vokula said the vast majority of managed service providers’ end customers “have no idea” what kind of software is used to keep their networks running,

Cassia said it sent a detection tool to nearly 900 customers on Saturday night.

John Hammond of Huntress Labs, one of the first cybersecurity companies to sound the alarm about the attack, said he saw $5 million and $500,000 from REVil for the decryption key needed to unlock shady networks. It appears that the smallest amount requested was $45,000.

Sophisticated ransomware gangs at the REvil level usually check a victim’s financial records – and insurance policies if they can find them – for the files they steal before activating the data-scrambling malware. Then the criminals threaten to dump the stolen data online unless it is paid. However, it was not immediately clear if this attack involved data theft. The mechanism of infection suggests that it did not.

“Data theft usually takes time and effort from the attacker, which is probably not possible in an attack scenario like this where there are a lot of small and medium-sized victim organizations,” said Ross McCircher, Sophos Chief Information Security Officer. “We haven’t seen evidence of data theft, but it’s still early days, and only time will tell if attackers resort to playing this card in an attempt to get victims to pay.”

Dutch researchers said they alerted Miami-based Cassia of the breach and said criminals used “zero-day,” the industry term for a previously unknown software vulnerability. Voccola did not confirm this or provide details of the breach – except to say it wasn’t phishing.

“The level of development here was extraordinary,” he said.

When cybersecurity firm Mandiant finished its investigation, Fukola said he was confident it would show criminals not only broke Kaseya’s code in breaking into his network but also exploited vulnerabilities in third-party software.

This was not the first ransomware attack to take advantage of managed service providers. In 2019, criminals disrupted the networks of 22 Texas municipalities through a single network. That same year, 400 American dental clinics were crippled in a separate attack.

One Dutch vulnerability researcher, Victor Jeffers, said his team is concerned about products like Kaseya’s VSA because of the complete control over the vast computing resources they can offer. “More and more products that are used to keep networks secure are showing structural weaknesses,” he wrote in a blog post on Sunday.

Cybersecurity firm ESET has identified victims in at least 17 countries, including the UK, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand and Kenya.

Kaseya says the attack only affected “in-house” customers, and organizations that run their own data centers, as opposed to cloud-based services that run software for customers. However, it has also shut down these servers as a precaution.

Kaseya, who called on customers Friday to shut down their VSA servers immediately, said Sunday that she hopes to get a patch in the next few days.

Active since April 2019, REvil provides ransomware as a service, which means it develops software that paralyzes the network and rents it to so-called affiliates that infect targets and take the lion’s share of the ransom. US officials say the most powerful ransomware gangs are based in Russia and allied countries, operating with the tolerance of the Kremlin and sometimes colluding with Russian security services.

Cyber ​​security expert Dmitriy Alperovich of the Silverado Policy Accelerator said that while he doesn’t believe the Kaseya attack was directed by the Kremlin, it shows Putin “has not yet moved” to shut down the cybercriminals.

___

Associated Press reporters Eric Tucker in Washington, Kirsten Grischapper in Berlin, Gary Tanner in Helsinki and Sylvie Corbett in Paris contributed to this report.

.

[ad_2]