Scale and Details of Kaseya’s Massive Ransomware Attack: NPR

[ad_1]

This file image shows the interior of a computer in Jersey City, New Jersey, where cybersecurity teams worked hard on Sunday, July 4, to stem the impact of the largest global ransomware attack ever recorded, with some details emerging about how the gang responsible for Russia hacked it. The company whose program was the channel. Jenny Kane / AP Hide caption

Toggle caption Jenny Kane/The Associated Press

This file image shows the interior of a computer in Jersey City, New Jersey, where cybersecurity teams worked hard on Sunday, July 4, to stem the impact of the largest global ransomware attack ever recorded, with some details emerging about how the gang responsible for Russia hacked it. The company whose program was the channel.

Jenny Kane / AFP

BOSTON – Cybersecurity teams worked frantically on Sunday to stem the impact of the largest global ransomware attack on record, with some details emerging about how the gang responsible for Russia hacked the company whose platform was the channel.

A subsidiary of the notorious REvil gang, which was notorious for extorting $11 million from JBS meat processor after the Memorial Day attack, infected thousands of victims in at least 17 countries on Friday, largely through companies running remote IT infrastructure for multiple clients. , cybersecurity researchers said.

Researchers said Revell was demanding a ransom of up to $5 million. But late Sunday, in a post on its dark web site, it offered the key to a global decryption software that would decrypt all affected devices for $70 million in cryptocurrency.

Earlier, the FBI said in a statement that while investigating the attack, its scale “may make it unable to respond to individual victims.” Deputy National Security Adviser Anne Neuberger later issued a statement saying that President Joe Biden had “directed the full resources of the government to investigate this incident” and urged all those who believed they were at risk to alert the FBI.

On Saturday, Biden suggested that the United States respond if it was determined that the Kremlin was at all involved.

Less than a month ago, Biden pressured Russian President Vladimir Putin to stop providing a safe haven to REvil and other ransomware gangs that view the United States’ relentless extortionate attacks as a threat to national security.

A wide range of companies and public agencies have come under attack recently, seemingly on all continents, including in financial services, travel, entertainment and the public sector — though few are large, cybersecurity firm Sophos said. Ransomware criminals infiltrate networks and plant malware that cripple them by shuffling all their data. Victims get the decryption key when they pay.

Swedish grocery chain Coop said most of its 800 stores would close for a second day on Sunday because their cash register software supplier was paralyzed. A Swedish pharmacy chain, a chain of gas stations, a state railway line and the SVT public broadcasting station were also bombed.

German news agency dpa reported that an unnamed information technology services company told authorities in Germany that several thousand of its customers had been put at risk. Among the reported victims are two large Dutch IT services companies – VelzArt and Hoppenbrouwer Techniek. Most ransomware victims do not publicly report attacks or disclose whether they have paid a ransom.

CEO Fred Fukola of the hacked software company, Kaseya, put the number of victims in the low thousands, mostly small businesses like “dental practices, architecture firms, plastic surgery centers, bookshops, and things like that.”

Vokula said in an interview that only 50 to 60 of the company’s 37,000 customers were at risk. But 70% were managed service providers using the company’s VSA hack to manage multiple clients. It automates software installation, security updates, backup management, and other vital tasks.

Experts say it was no coincidence that Revell launched the attack at the start of the 4th of July weekend, knowing that US offices would have few employees. Many victims may not know this until they return to work on Monday. Most end users of managed service providers “have no idea” whose software keeps their networks running, Vokula said.

Cassia said it sent a detection tool to nearly 900 customers on Saturday night.

Alan Liska, an analyst at cybersecurity firm Recorded Future, said REvil’s offer to offer comprehensive decryption to all victims of the Kaseya attack for $70 million indicates its inability to handle the massive amount of infected networks. Although analysts reported seeing requests of $5 million and $500,000 for larger targets, she was apparently asking for $45,000 for most of them.

“This attack is much bigger than they expected and is getting a lot of attention,” Liska said. “This is a nightmare to manage.”

Emsisoft analyst Brett Kalou said he suspects REvil is hoping insurers will analyze the numbers and determine that $70 million will be cheaper for them than the extended layoff.

Sophisticated REvil-level ransomware gangs usually check a victim’s financial records – and insurance policies if they can find them – for files they steal before activating the ransomware. Then the criminals threaten to dump the stolen data online unless it is paid. In this attack, that didn’t seem to happen.

Dutch researchers said they alerted Miami-based Cassia of the breach and said criminals used “zero-day,” the industry term for a previously unknown software vulnerability. Voccola did not confirm this or provide details of the breach – except to say it wasn’t phishing.

“The level of sophistication here was extraordinary,” he said.

When cybersecurity firm Mandiant finished its investigation, Fukola said he was confident it would show criminals not only broke Kaseya’s code in breaking into his network but also exploited vulnerabilities in third-party software.

This was not the first ransomware attack to take advantage of managed service providers. In 2019, criminals disrupted the networks of 22 Texas municipalities through a single network. That same year, 400 American dental clinics were crippled in a separate attack.

One Dutch vulnerability researcher, Victor Jeffers, said his team is concerned about products like Kaseya’s VSA because of the complete control over the vast computing resources they can offer. “More and more products being used to keep networks secure are showing structural weaknesses,” he wrote in Sunday’s blog.

Cybersecurity firm ESET has identified victims in at least 17 countries, including the UK, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand and Kenya.

Kaseya says the attack only affected “in-house” customers and organizations running their own data centers, as opposed to cloud-based services that run software for customers. However, it has also shut down these servers as a precaution.

Kaseya, who called on customers Friday to shut down their VSA servers immediately, said Sunday that she hopes to get a patch in the next few days.

Active since April 2019, REvil provides ransomware as a service, which means it develops software that paralyzes the network and rents it to so-called affiliates that infect targets and take the lion’s share of the ransom. US officials say the most powerful ransomware gangs are based in Russia and allied countries, operating with the tolerance of the Kremlin and sometimes colluding with Russian security services.

Cyber ​​security expert Dmitriy Alperovich of the Silverado Policy Accelerator said that while he doesn’t believe the Kaseya attack was directed by the Kremlin, it shows that Putin “has not yet moved” in shutting down cybercriminals.

[ad_2]