Scourge · July 2 2021

The Scourge of Kaseya

Chronicle

On Friday 2 July 2021, on the eve of the long US Independence Day weekend, the REvil gang exploited zero-days in Kaseya's VSA remote-management software to push its ransomware through about 60 managed service providers to roughly 1,500 client businesses. In Sweden the Coop supermarket chain had to close hundreds of stores because its tills stopped working. The Dutch institute DIVD had already reported the flaw and was coordinating the fix. The attackers demanded $70 million for a universal decryptor.

Lesson learned

It proved that a single remote-management tool can become a ransomware distribution channel to thousands of victims, and that managed service providers are a high-value target.

Prayer of reparation

O VSA, who were meant to manage customers' computers and ended up encrypting them, protect the consoles that hold everyone's keys and shorten the race between those who report and those who attack. Amen.

How it is remembered

Remembered by keeping remote-management consoles off the Internet, requiring MFA to use them and asking your providers how they protect the tools they manage you with.