{"id":1704,"date":"2021-07-05T07:24:50","date_gmt":"2021-07-05T07:24:50","guid":{"rendered":"https:\/\/www.attack-secure.com\/?p=1704"},"modified":"2023-01-09T11:16:49","modified_gmt":"2023-01-09T11:16:49","slug":"huge-supply-chain-attack-affects-200-msps-with-revil-ransomware","status":"publish","type":"post","link":"https:\/\/www.attack-secure.com\/huge-supply-chain-attack-affects-200-msps-with-revil-ransomware\/","title":{"rendered":"Huge supply chain attack affects 200 MSP’s with REvil ransomware"},"content":{"rendered":"\n

On Friday, many managed service providers (MSPs) started experiencing potential attack and it was confirmed to be a ransomware attack via Kaseya VSA that was exploited using a supply-chain attack. The ransomware was confirmed to be REvil ransomware, also known as Sodinokibi ransomware. This ransomware was targeted towards MSPs and has found to have exploited the zero day vulnerability in Kaseya VSA.<\/p>\n\n\n\n

Kaseya VSA is a remote monitoring and management (RMM) tool<\/strong> that has been used by IT departments and MSPs for remotely monitoring their employees and client devices respectively. The features include remote access, patch management, server\/endpoint management and more. It has been a very popular tool in the MSP community just like how Solarwinds was.<\/p>\n\n\n\n

Meanwhile, the Huntress team is active on Reddit<\/a> updating the MSP community above the attack and how Kaseya VSA users have been the victim of this attack. Also claims to have proof that Kaseya VSA is the entry point of the attack, as their clients have been impacted by this attack and around 200 businesses data have been encrypted through their three partners.<\/p>\n\n\n\n

On the other hand, Kaseya published a security advisory<\/a> requesting their VSA users to shutdown their server imminently to prevent the spread of the attack. And below is a gist of Kaseya’s statement,<\/p>\n\n\n\n

“We are experiencing a potential attack against the VSA that has been limited to a small number of on-premise customers only as of 2:00 PM EDT today.<\/p>\n\n\n\n

We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you IMMEDIATELY shutdown your VSA server until you receive further notice from us.<\/p>\n\n\n\n

Its critical that you do this immediately, because one of the first things the attacker does is shutoff administrative access to the VSA.”<\/p>\n\n\n\n

Kaseya shutdown their VISA servers from their side, and is now working with other security firms to handle the situation and understand what is happening with their application. A major ransoware attack happening on Friday right before the weekend, and also with July 4th coming up. Considering this would be a long weekend for most of the organization, ransomware actors have clearly planned the attack and launched it accordingly.<\/p>\n\n\n\n

Modus Operandi of the attack<\/strong><\/h2>\n\n\n\n

Based on the statements from John Hammond, Huntress<\/a> and Mark Loman, Sophos<\/a> the attack is identified to be a supply chain attack through Kaseya VSA platform.<\/p>\n\n\n\n