{"id":7480,"date":"2021-07-15T13:31:58","date_gmt":"2021-07-15T13:31:58","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7480"},"modified":"2021-07-15T13:36:40","modified_gmt":"2021-07-15T13:36:40","slug":"kaseya-ransomware-attack-update","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/","title":{"rendered":"Kaseya Ransomware Attack Update: What You Need To Know"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7480\" class=\"elementor elementor-7480\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">The cyber security world was rattled last week with the revelation of the largest ever ransomware attack &#8211; the <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403584098961\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Kaseya ransomware attack<\/span><\/a><span style=\"font-weight: 400;\">. A complicated mix of zero-day, supply chain, and ransomware attacks, the Kaseya ransomware attack was a sophisticated ransomware attack which compromised the on-premises version of the Kaseya VSA, a tool used by Managed Service Providers (MSPs) to connect to customer\u2019s systems.<\/span><\/p><p><span style=\"font-weight: 400;\">The timing couldn\u2019t have been better. The attack was launched at 2pm EDT on Friday 2nd July, just as IT security teams across the United States were getting ready to knock off for the long July 4th weekend. We take a look at the attack itself, its aftermath, what this attack means for the future of ransomware attacks, and what organisations can do to keep themselves safe in times like these.<\/span><\/p><h2><span style=\"font-weight: 400;\">Intro to the players &#8211; Kaseya and REvil<\/span><\/h2><p><a href=\"https:\/\/www.kaseya.com\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Kaseya<\/span><\/a><span style=\"font-weight: 400;\"> is an Irish-owned IT solutions developer for MSPs and enterprise clients. They have offices in 10 countries, including one in Florida in the United States. This is significant, as the United States MSP supply chain appears to have been the epicenter of the attack.<\/span><\/p><p><span style=\"font-weight: 400;\">Kaseya is a key player in the wider software supply chain. Among Kaseya\u2019s IT solutions is a virtual system administrator (VSA) platform which is used by customers including managed service providers (MSPs) to manage their own customers\u2019 IT estates. Kaseya appears to have been targeted by REvil because they could open up such a large number of downstream customers.<\/span><\/p><p><a href=\"https:\/\/www.tripwire.com\/state-of-security\/featured\/revil-ransomware-what-you-need-to-know\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">REvil<\/span><\/a><span style=\"font-weight: 400;\"> is a Russian based ransomware group, also known as Sodinokibi. REvil first rose to prominence in April 2019, and have gained a reputation for being a hard hitting ransomware gang, providing ransomware as a services (RaaS) services for other cyber criminals. REvil heavily use double extortion tactics against their victims &#8211; they usually steal data from their victims before encrypting their systems, and threaten to publish the stolen data through their website, also known as the Happy Blog.<\/span><\/p><p><span style=\"font-weight: 400;\">REvil have been unusually successful in earning large ransoms from their victims. In 2021 alone, REvil demanded a <\/span><a href=\"https:\/\/www.zdnet.com\/article\/acer-reportedly-targeted-with-50-million-ransomware-attack\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">$50 million ransom<\/span><\/a><span style=\"font-weight: 400;\"> from Taiwanese hardware producer Acer, received an $11 million ransom from meat packing giants <\/span><a href=\"https:\/\/latesthackingnews.com\/2021\/06\/14\/jbs-paid-11-million-ransom-revil-initially-demanded-22-million\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">JBS<\/span><\/a><span style=\"font-weight: 400;\">, and tried to extort a ransom from <\/span><a href=\"https:\/\/www.techradar.com\/news\/apple-supplier-quanta-confirms-ransomware-attack\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Apple<\/span><\/a><span style=\"font-weight: 400;\"> through a ransomware attack on Apple\u2019s supplier Quanta, that stole data rather than encrypting it.<\/span><\/p><p><span style=\"font-weight: 400;\">The Kaseya ransomware attack was a highly sophisticated attack, requiring REvil to up their game considerably. They scaled up their operations considerably from a single target to a supply chain target, which was not entirely new for REvil as they had some success carrying out a supply chain attack in 2019 when they hacked TSM Consulting Services, a web services provider in Texas. On that occasion they impacted 22 of the company\u2019s customers. This time they went one level higher in the supply chain to reach 60 MSPs.<\/span><\/p><h2><span style=\"font-weight: 400;\">What do we know about the Kaseya ransomware attack?<\/span><\/h2><p><b>It likely began much sooner than 2nd July<\/b><\/p><p><span style=\"font-weight: 400;\">The Kaseya ransomware attack was launched on Friday 2nd July, although it likely started back in May when REvil were able to gain access to Kaseya\u2019s VSA and begin uploading agent files in order to start carrying out the required steps to carry out the attack.<\/span><\/p><p><b>It is a supply chain attack with the added twist of ransomware<\/b><\/p><p><span style=\"font-weight: 400;\">The Kaseya ransomware attack was deliberately aimed at the supply chain in order to gain access to a larger pool of customers.<\/span><\/p><p><b>The attack only impacted MSPs using Kaseya\u2019s on-premises VSA<\/b><\/p><p><span style=\"font-weight: 400;\">The attack was initiated by leveraging a vulnerability in Kaseya\u2019s VSA software, and using it as a launch pad against multiple MSPs and their customers. However the attack only affected on-premise Kaseya VSA customers, and did not impact on the SaaS VSA. Latest updates suggest that more than 60 MSPs were impacted, and through them, over 1,500 organisations were hit by the attack, including most famously the<\/span><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/coop-supermarket-closes-500-stores-after-kaseya-ransomware-attack\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\"> Swedish Coop supermarket chain<\/span><\/a><span style=\"font-weight: 400;\"> who had to close all 800 stores for several days as they couldn\u2019t open their cash registers.<\/span><\/p><p><b>The exploited vulnerability was a zero day bug which was already being actively worked on<\/b><\/p><p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/csirt.divd.nl\/2021\/07\/04\/Kaseya-Case-Update-2\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">authentication bypass vulnerability<\/span><\/a><span style=\"font-weight: 400;\"> (vulnerability CVE-2021-30116) was a zero day vulnerability that Kaseya had already been made aware of by the Dutch Institute for Vulnerability Disclosure (DIVD), and were in the process of patching it. Early patch versions had already been released to the DIVD to assess their effectiveness. Unfortunately the attack was launched before this work was completed.<\/span><\/p><p><b>REvil demanded a record breaking ransom<\/b><\/p><p><span style=\"font-weight: 400;\">REvil demanded a collective <\/span><a href=\"https:\/\/www.zdnet.com\/article\/kaseya-ransomware-attack-us-launches-investigation-as-gang-demands-giant-70-million-payment\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">$70m ransom<\/span><\/a><span style=\"font-weight: 400;\"> to release a universal decryption key. At the same time they were also <\/span><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/revil-is-increasing-ransoms-for-kaseya-ransomware-attack-victims\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">demanding $5m for affected managed services providers<\/span><\/a><span style=\"font-weight: 400;\">, and a sliding scale starting at $44,999 from affected downstream customers, creating chaos across the affected organisations.<\/span><\/p><p><span style=\"font-weight: 400;\">There is no evidence so far that Kaseya has paid the ransom, and neither have any of the affected MSPs. There are suggestions that some of the impacted downstream victims have tried to pay their ransoms. The ransom pays for an unencrypting tool created by REvil, which is supposed to help businesses get back online sooner.\u00a0<\/span><\/p><h2><span style=\"font-weight: 400;\">How did the Kaseya ransomware attack happen?<\/span><\/h2><p><span style=\"font-weight: 400;\">The exact chain of events that lead to the attack is still to be determined. However Kaseya themselves say that REvil were able to <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403584098961\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">exploit zero day vulnerabilities<\/span><\/a><span style=\"font-weight: 400;\"> in the VSA product to bypass authentication and run arbitrary command execution. Through this, they were able to access the VSA product and deploy the ransomware to endpoints.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Once inside Kaseya\u2019s systems, the <\/span><a href=\"https:\/\/www.cybereason.com\/blog\/cybereason-vs-revil-ransomware-the-kaseya-chronicles\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">hackers carried out several tasks<\/span><\/a><span style=\"font-weight: 400;\"> before pushing the ransomware as an update called \u201cKaseya VSA Agent Hot-fix\u201d.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">On gaining access to the targeted environment REvil used the Kaseya Agent Monitor to write a base 64 decoded file called agent.crt (the ransomware dropper) to the path c:\\kworking\\ and execute a series of commands that disabled security controls. The agent.crt file was then renamed to agent.exe and executed the dropper.<\/span><\/p><p><span style=\"font-weight: 400;\">The ransomware was signed with what on the surface looked like a legitimate certificate (PB03 TRANSPORT LTD) in order to evade detection.<\/span><\/p><p><span style=\"font-weight: 400;\">Next, REvil placed the ransomware dropper in the system, taking care to hide their actions, using DLL Side-Loading to drop an outdated version for Windows Defender using that response from that action to write the new script.<\/span><\/p><p><span style=\"font-weight: 400;\">Finally, they executed the ransomware (mpsvc.dll) with a command to change the firewall settings to allow local windows systems to be discovered, encrypting files, and eventually delivering the ransomware note.<\/span><\/p><h2><span style=\"font-weight: 400;\">The response from Kaseya<\/span><\/h2><p><span style=\"font-weight: 400;\">When the attack hit, <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403584098961\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Kaseya<\/span><\/a><span style=\"font-weight: 400;\"> proactively shut down its SaaS servers, and pulled data centres offline. They notified customers as soon as quickly as possible by email, in-product notifications, and by phone. The Incident Response team mobilised immediately to investigate, and the firm called in FireEye and other cyber forensics experts to assist.<\/span><\/p><p><span style=\"font-weight: 400;\">Kaseya say that their very quick response to the attack limited the extent to a relatively small number (60 out of 36,000 customers) of on-premises customers only. The company maintains that the SaaS product was not affected. SaaS and hosted VSA servers were given upgraded security features, and the plan is to slowly bring servers back online region by region starting with the EU, UK and APAC data centres. Kaseya were hoping to begin bringing SaaS servers back online within a few days of the attack, but had to delay until 11 July. Systems are now returning online.<\/span><\/p><p><span style=\"font-weight: 400;\">The team quickly identified the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/indicators-of-compromise-analysis-is-half-the-story\/\"><span style=\"font-weight: 400;\">indicators of compromise<\/span><\/a><span style=\"font-weight: 400;\"> of the attack, and circulated them to customers and security researchers to help them investigate the attacks. The full set of indicators can be found <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403584098961\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">here<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">R&amp;D replicated the attack vendor in order to understand it, and ensure that their mitigations are effective.<\/span><\/p><p><span style=\"font-weight: 400;\">As mentioned above, Kaseya were already aware of the vulnerability that led to the attack, and were working on the patch before the attack was launched. Following the attack, all customers using the on-prem VSA version were taken down, and customers are advised to remain offline until the patch is released. The patch was released on 11 July.<\/span><\/p><h2><span style=\"font-weight: 400;\">Protect yourself from cyber attacks<\/span><\/h2><p><span style=\"font-weight: 400;\">Customers and other organisations who suspect they are victims of the attack can <\/span><a href=\"https:\/\/kaseya.app.box.com\/s\/0ysvgss7w48nxh8k1xt7fqhbcjxhas40\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">download<\/span><\/a><span style=\"font-weight: 400;\"> a compromise detection tool from Kaseya. This tool analyses systems and looks for any <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/indicators-of-compromise-analysis-is-half-the-story\/\"><span style=\"font-weight: 400;\">indicators of compromise<\/span><\/a><span style=\"font-weight: 400;\">. Keep up to date with the latest news from Kaseya <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403440684689\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">here<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">Every organisation, whether they are connected to Kaseya or not, should remain cautious of copycats or <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/6-social-engineering-tactics-in-action-in-2021\/\"><span style=\"font-weight: 400;\">phishing scams<\/span><\/a><span style=\"font-weight: 400;\"> as other cyber criminals try to cash into the confusion surrounding the attack. <\/span><a href=\"https:\/\/helpdesk.kaseya.com\/hc\/en-gb\/articles\/4403440684689\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Kaseya warned on 8th July<\/span><\/a><span style=\"font-weight: 400;\"> that there are fake emails circulating claiming to be from Kaseya. Kaseya will not send out emails with links or attachments.<\/span><\/p><p><a href=\"https:\/\/outofsite.biz\/cynance\/cyber-security-trends-2021-after-2020-perfect-storm\/\"><span style=\"font-weight: 400;\">Avoiding a cyber attack entirely<\/span><\/a><span style=\"font-weight: 400;\"> is almost impossible as cyber criminals become more and more sophisticated, evolving their methods, and integrating new tools and techniques of their own. However, preparation is key, and knowing your cyber security risks, understanding your infrastructure, and putting in measures to protect yourself <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/manchester-united-cyber-attack-a-textbook-response\/\"><span style=\"font-weight: 400;\">will definitely limit the impact<\/span><\/a><span style=\"font-weight: 400;\"> of an attack. These measures include but are not limited to:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Regularly <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">check your infrastructure<\/span><\/a><span style=\"font-weight: 400;\"> to ensure that it is secure. Enact any mitigation recommendations as quickly as possible.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Protect your <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">network perimeter<\/span><\/a><span style=\"font-weight: 400;\"> using up to date software, and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/improve-email-security-dmarc-email-authentication\/\"><span style=\"font-weight: 400;\">employing tools<\/span><\/a><span style=\"font-weight: 400;\"> where necessary.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Enforce strong identity and access management controls, including enabling <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/secure-passwords-dont-protect-network-security\/\"><span style=\"font-weight: 400;\">multi factor authentication<\/span><\/a><span style=\"font-weight: 400;\"> on all accounts, central controls for access to sensitive applications, and the principle of least privilege.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">Be prepared<\/span><\/a><span style=\"font-weight: 400;\">: Make regular backups of your files, and check that the backups are easily restorable. Create an effective Disaster Recovery plan, and test it, so that you are ready to hit the ground running following an incident.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Every organisation relies on numerous IT related suppliers in order to do their jobs on a daily basis. The trick is to understand the risks of using those suppliers, and in having local protections that improve your own cyber security posture locally.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The cyber security world was rattled last week with the revelation of the largest ever ransomware attack &#8211; the Kaseya ransomware attack. A complicated mix of zero-day, supply chain, and ransomware attacks, the Kaseya ransomware attack was a sophisticated ransomware attack which compromised the on-premises version of the Kaseya VSA, a tool used by Managed&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7492,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7480"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7480"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7480\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7492"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}