Lessons from the Kaseya VSA Supply-Chain Ransomware Attack
Summary
Huntress reviews the 2021 REvil attack through Kaseya VSA, describing its impact on MSPs and customers, key attack steps, the decryption key’s arrival, and lessons on vendor security and incident preparedness.
Key points
- REvil’s July 2, 2021, attack used Kaseya VSA to reach MSPs and downstream customers; Huntress estimated 50–60 MSPs and 1,500–2,000 customers were affected.
- Huntress describes the attack chain as authentication bypass, arbitrary file upload, and code execution; it says the initial bypass method remained unknown to its researchers.
- After gaining an authenticated session, attackers uploaded agent.crt, described as the ransomware payload, and Screenshot.jpg, which Huntress says prepared VSA to deploy ransomware to endpoints.
- Huntress says the authentication bypass could circumvent multi-factor authentication and provide access to the database controlling client machines.
- Huntress developed and deployed a protective “vaccine” for partner systems, while noting risks including configurable paths and potential changes by the attackers.
- A universal decryption key surfaced on July 22. Kaseya said it had not paid for the decryption tool, but the key’s origin remained undisclosed in the article.
- The article recommends regularly evaluating security tools, coordinating configurations with vendors, and maintaining and testing an incident response plan.
Article Details
- Topic
- Lessons learned from the REvil ransomware supply chain attack targeting Kaseya VSA and its downstream MSP customers.