{"id":7521,"date":"2021-07-12T20:07:04","date_gmt":"2021-07-13T03:07:04","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7521"},"modified":"2023-04-05T12:39:04","modified_gmt":"2023-04-05T19:39:04","slug":"kaseya-vsa-downed-by-revil-in-monumental-supply-chain-attack","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/kaseya-vsa-downed-by-revil-in-monumental-supply-chain-attack\/","title":{"rendered":"Kaseya VSA Downed by REvil in a Monumental Supply Chain Attack"},"content":{"rendered":"
\n

On July 21, 2021, Kaseya shared a universal decryptor key<\/a> with all MSPs and their clients who were affected by the REvil ransomware attack. The decryptor key can restore all encrypted files for free.<\/strong><\/p>\n<\/blockquote>\n

On the night of July 02, 2021, as security teams logged off their servers preparing for the Independence Day weekend, Kaseya\u2019s remote management web-based software platform Kaseya VSA was breached by the infamous REvil gang<\/a>, resulting in the single largest ransomware supply chain attack in the United States. In total, more than 1,500 companies were impacted by the REvil ransomware attack across 17 countries, with 60 MSPs and 800+ companies in the United States alone. The Swedish supermarket giant Coop <\/a>was the worst hit, having to close 800 stores worldwide.<\/p>\n

The event happened when the REvil gang gained backend access and deployed a malicious update to the VSA servers running on the client premises. Not only did that compromise the client\u2019s VSA servers and infect all connected workstations, but also it effectively infected the networks of third-party companies that were using the attacked server.<\/p>\n

The effect of the Kaseya attack continues to be felt as third-party dependencies see a swarm of ransomware attacks, not just pertaining to the REvil attack on July 03 but also other ransomware gangs conducting Cobalt Strike phishing campaigns<\/a> to exploit the vulnerabilities. There has been a spate of third-party attacks on municipalities such as Leonardtown<\/a> and North Beach<\/a> in Alabama and utility sectors such as Wiregrass Electric Cooperative<\/a> in the wake of the Kaseya VSA supply chain shutdown. More recently, fake phishing campaign emails containing malicious links or attachments posing as Kaseya security updates have been reported <\/a>trying to enter recipients\u2019 systems through the backdoor.<\/p>\n

Could Kaseya Have Avoided the Attacks?<\/strong><\/h2>\n

Yes. On July 08, 2021, the Dutch Institute of Vulnerability Disclosure (DIVD) published a timeline <\/a>of the attack, which indicates that the vulnerability was reported to Kaseya as early as April 2021. Six of the seven vulnerabilities were found to be affecting software-as-a-service and on-premise VSA servers.<\/p>\n

In the attack on Kaseya VSA on July 03, 2021, the company was patching one of the three critical zero-day bugs, CVE-2021-30116<\/a>, when the vulnerability was used to bypass authentication on the web panel. Immediately after, SQL commands were run on the VSA appliance, and ransomware was deployed to all connected workstations. However, it is still uncertain how the REvil gang got its hands on the classified information on the zero-day bug.<\/p>\n

\n

Most ransomware gangs like REvil are going after organizations<\/a> whose supply chain, if affected, can cause widespread panic and chaos.<\/p>\n<\/blockquote>\n

According to our research findings published in Securin\u2019s Ransomware Spotlight 2021 <\/a>report, the REvil ransomware gang, amongst other ransomware gangs, has targeted organizations with supply chains in order to cause the maximum damage.<\/p>\n

More CVE Findings<\/strong><\/h2>\n

In our previous blog<\/a>, we observed how six vulnerabilities\u2014CVE-2012-0507,\u00a0 CVE-2013-0074, CVE-2018-8453, CVE-2019-11510, CVE-2019-19781, and CVE-2019-2725\u2014were associated with REvil in the attack that befell JBS on May 30, 2021.<\/p>\n

During the more recent Kaseya VSA attack, the REvil ransomware group exploited a zero-day bug, now tagged as CVE-2021-30116<\/a>, to conduct remote code execution that affected 140 publicly accessible VSA servers<\/a>. Here is our analysis of the vulnerability:<\/p>\n

CVE-2021-30116<\/strong><\/p>\n