Kaseya Security Incident

REvil ransomware actors attack Kaseya in supply chain attack By Joe Marshall Friday, July 2, 2021 22:03 ransomware SecureX Updated on July 6, 2021: As analysis of the ransomware attack affecting organizations using Kaseya VSA has continued, we are sharing an update containing additional information. As new details are identified, this information may be updated as needed. This event consisted of two separate, but related incidents. The initial compromise was the result of a zero-day attack against MSSPs that enabled adversaries to conduct a service supply chain attack on additional victims. The initial compromise of Kaseya VSA servers appears to have been the result of the successful exploitation of an unpatched software vulnerability (CVE-2021-30116) which allowed attackers to obtain privileged access to vulnerable Kaseya VSA servers for the purposes of ransomware deployment. Ransom demands varied across victim organizations. This indicates that once attackers obtained access to VSA servers, the server configuration was analyzed to identify victims prior to the activation of malicious ransomware payloads. The absence of data exfiltration activity, deletion of shadow copies on infected systems, and the advertisement of a campaign-wide decryption key is a notable divergence from the TTPs typically observed during REvil ransomware attacks. The REvil ransomware samples identified as being associated with this attack were configured to disable communication with C2 infrastructure that is normally used to send encryption information and statistics. During the infection process, the current system time is compared to July 2, 2021 at 12:30 ET. At this time, the ping function is executed, which causes a delay between the initial infection and when additional malicious activity may be detected on systems. Event Timeline July 2, 2021 The first observed command execution activity indicating an attack in progress occurred at 10:30:58 ET. The parent process, in this case,...

... (truncated for display)