This month’s Kaseya VSA ransomware attack took a turn for the worse on Wednesday with word that miscreants have launched a phishing campaign to ensnare victims with a remote-control tool disguised as a VSA update.
Since late last week, instances of VSA – Kaseya’s monitoring and management software for fleets of PCs and other IT gear – have been exploited to distribute REvil ransomware, prompting the biz to shut down its Kaseya Cloud service and to tell customers to turn off their on-prem Kaseya VSA servers while it worked on a patch for whatever vulnerability is being abused.
The malware outbreak, which has yet to be resolved, is said to have affected as many as 1,500 businesses through compromised VSA systems, and has been compounded by Kaseya’s decision to delay patch deployment on Wednesday. The company is currently hoping to restore its Cloud Service on the evening of Thursday, July 8.
The software maker told its on-prem customers, “we will be publishing a runbook of the changes to make to your on-premises environment by 3PM US EDT today so customers can prepare for the patch release.”
The gap in patch deployment has provided attackers with an opportunity to fill the void. Security companies have warned that miscreants have undertaken a malware spam campaign to distribute payloads of Cobalt Strike, a post-exploitation penetration and security testing tool used for both legitimate and malicious purposes.
According to MalwareBytes, the phishing emails contain “an attachment named ‘SecurityUpdates.exe’ as well as a link pretending to be a security update from Microsoft to patch the Kaseya vulnerability.” Installing this will actually put Cobalt Strike code on your system, allowing it to be commandeered from afar.
The compromise of Kaseya VSA instances was done using vulnerabilities that were confidentially disclosed to the company by the Dutch Institute for Vulnerability Disclosure. In a blog post on Wednesday, the DIVD’s CSIRT group said the attack used “a vulnerability which we confidentially disclosed to Kaseya [in April], together with six other vulnerabilities.”
It’s not clear how the attackers learned of the vulnerabilities, but supply chain attacks have been the focus of cybercrime groups for the past several months. ®
[ad_2]
Source link
Is your business effected by Cyber Crime?
If a cyber crime or cyber attack happens to you, you need to respond quickly. Cyber crime in its several formats such as online identity theft, financial fraud, stalking, bullying, hacking, e-mail fraud, email spoofing, invoice fraud, email scams, banking scam, CEO fraud. Cyber fraud can lead to major disruption and financial disasters. Digitpol can assist with all stages of cyber related incidents.
Contact Digitpol’s hotlines or respond to us online.
ASIA +85239733884
Europe +31558448040
UK +44 20 8089 9944
