Kaseya Supply-Chain Attack Hits Nearly 40 Service Providers With REvil Ransomware

Threat actors behind the notorious REvil cybercrime operation appear to have pushed ransomware via an update for Kaseya’s IT management software, hitting around 40 customers worldwide, in what’s an instance of a widespread supply-chain ransomware attack.

“Beginning around mid-day (EST/US) on Friday, July 2, 2021, Kaseya’s Incident Response team learned of a potential security incident involving our VSA software,” the company’s CEO Fred Voccola said in a statement shared late Friday.

Following the incident, the IT and security management services company said it took immediate steps to shut down its SaaS servers as a precautionary measure, in addition to notifying its on-premises customers to shut down their VSA servers to prevent them from being compromised.

Voccola also said the company has identified the source of the vulnerability and that it’s readying a patch to mitigate the ongoing issues. In the interim, the company also noted it intends to keep all on-premise VSA servers, SaaS, and hosted VSA servers shut down until it’s safe to resume operations.

According to Sophos Malware Analyst Mark Loman, the industry-wide supply-chain attack leverages Kaseya VSA to deploy a variant of the REvil ransomware into a victim’s environment, with the malicious binary side-loaded via a fake Windows Defender app to encrypt files in return for a ransom demand of $5 million.

The attack chain also involves attempts to disable Microsoft Defender Real-Time Monitoring via PowerShell, Loman added. The trojanized software is being distributed in the form of a “Kaseya VSA Agent Hot-fix,” Huntress Labs said in a Reddit post detailing the workings of the breach.

The researchers noted they had found eight managed service providers (MSPs), companies that provide IT services to other companies, that had been hit by the attack. About 200 businesses that are served by these MSPs have been locked out of parts of their network, Huntress Labs said.

As the ransomware crisis continues to spiral, MSPs have emerged as a lucrative target, mainly because a successful break-in opens up access to multiple clients, rendering them all vulnerable. With supply chain attacks becoming frequent in the wake of the sprawling SolarWinds campaign, a supply chain attack that targets MSPs to distribute ransomware has exponential consequences, enabling bad actors to strike hundreds of victims at once.

Update: In a revised advisory shared on Saturday, Kaseya said it had been the “victim of a sophisticated cyberattack,” while warning customers to refrain from clicking on any links sent in communications with the ransomware operators. “They may be weaponized,” the company cautioned.

Besides roping in cybersecurity firm FireEye Mandiant to identify the indicators of compromise (IoCs), the company is recommending businesses to keep all on-premises VSA servers offline until further notice and use a Compromise Detection Tool that it has made available to commence the recovery process.

Huntress Labs said it’s tracking close to 30 MSPs across the U.S., Australia, European Union, EU, and Latin America, where Kaseya VSA was used to encrypt new fewer than 1,000 businesses.

“All of these VSA servers are on-premises and Huntress assesses with high confidence that cybercriminals exploited a vulnerability to gain access into these servers,” Huntress Labs researcher John Hammond said.

This raises the possibility that REvil used a zero-day flaw in Kaseya VSA software to gain access to the systems, making it the first time a ransomware group has used a zero-day in attacks. Kaseya, for its part, noted that it had isolated and replicated the attack vector, and that it’s working towards adding software remediations to address the security weakness.