Huntress Traces Kaseya VSA Supply-Chain Ransomware Attack, Validates Patch

Jul 3, 2021 · Original article ↗

Summary

Huntress traced a Kaseya VSA attack that encrypted over 1,000 businesses through about 30 MSPs. Its investigation identified the exploit chain and ransomware deployment, and Huntress later validated Kaseya’s on-premises patch.

Key points

Huntress reported tracking about 30 affected MSPs across the US, Australia, Europe, and Latin America, with VSA used to encrypt more than 1,000 businesses.
Huntress confirmed exploitation of an arbitrary file upload and code-injection vulnerability, and said it had high confidence attackers also used an authentication bypass.
Logs and uploaded files supported a chain involving agent.crt and Screenshot.jpg; Huntress reported that code in Screenshot.jpg could disable user sessions and remove IIS logs.
Observed commands disabled Windows security protections, decoded and ran the ransomware payload, and used legitimate Windows Defender components to sideload mpsvc.dll.
Huntress assessed that a REvil/Sodinokibi affiliate was likely responsible, based on forensic patterns, ransom notes, and a TOR URL.
On July 11, Kaseya released an on-premises VSA patch; Huntress validated it and reported that its proof-of-concept exploit no longer worked.
Before restoring connectivity, Huntress recommended clearing pending VSA jobs that could trigger further downstream ransomware deployment.

Article Details

Attack Vectors: Attackers exploited an authentication bypass in the Kaseya VSA web interface to obtain an authenticated session, upload files, and execute commands through SQL injection.
The attack used Kaseya VSA procedures to distribute and run the ransomware payload across downstream endpoints.
The uploaded agent.crt file was decoded into agent.exe with certutil.exe; agent.exe then side-loaded the encryptor payload mpsvc.dll through the legitimate MsMpEng.exe executable.
Defensive Notes: Keep on-premises Kaseya VSA servers offline until they are patched.
Install Kaseya's validated 9.5.7a (9.5.7.2994) Feature Release patch; Huntress reported that its proof-of-concept exploit failed after the patch was installed.
Before restoring internet connectivity or beginning recovery, clear pending VSA procedures, scripts, and jobs; the article also recommends running the VSA SQL Audit Report tool.
After patch installation, VSA prompts users to change their passwords to meet the new policy requirements.

Indicators of compromise

Type	Indicator	Context
IPV4	`161[.]35[.]239[.]148`	Listed as an attacker source IP discovered by TrueSec in the Kaseya VSA incident.
IPV4	`162[.]253[.]124[.]162`	Listed as an attacker source IP discovered by Kaseya in the incident.
IPV4	`18[.]223[.]199[.]234`	Observed source IP for requests to compromised Kaseya VSA servers; Huntress noted it used shared hosting and may have been a compromised legitimate server.
IPV4	`35[.]226[.]94[.]113`	Listed as an attacker source IP discovered by Kaseya in the incident.
MD5	`561cffbaba71a6e8cc1cdceda990ead4`	MD5 hash of agent.exe, identified as the decoded contents of agent.crt and the ransomware encryptor.
MD5	`939aae3cc456de8964cb182c75a5f8cc`	MD5 hash of agent.crt, identified as encoded malicious content.
MD5	`a47cf00aedf769d60d58bfe00c0b5421`	MD5 hash of the mpsvc.dll REvil encryptor payload.
SHA256	`8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd`	SHA-256 hash of an mpsvc.dll sideloaded encryptor payload reported by others.
SHA256	`d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e`	SHA-256 hash of the agent.exe ransomware encryptor.
SHA256	`e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2`	SHA-256 hash of an mpsvc.dll sideloaded encryptor payload observed by Huntress.