Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software

Last week cybercriminals deployed ransomware to 1,500 organizations, including many that provide IT security and technical support to other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large...

Details of the REvil Ransomware Attack

ArsTechnica has a good story on the REvil ransomware attack of last weekend, with technical details: This weekends attack was carried out with almost surgical precision. According to Cybereason, the REvil affiliates first gained access to targeted environments and then used the zero-day in the...

Kaseya update delayed for security reasons

Software vendor Kaseya has been caught in the chaos of a supply-chain compromise by the REvil ransomware gang since Friday. Around 40 managed service providers MSPs that rely on Kaseya VSA software to administer customers IT—and up to 1,500 of their customers—have been stricken with the ransomwar...

REvil Ransomware gang behind the Kaseya VSA Supply-Chain attack

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. The REvil ransomware group was successful in carrying out a supply chain attack by exploiting the zero-day vulnerability CVE-2021-30116 in the Kaseya VSA server and delivering a malicious script to all the computer devices...

DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks

Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. The Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of...

Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)

Summary Last week Microsoft warned Windows users about vulnerabilities in the Windows Print Spooler service – CVE-2021-1675 and CVE-2021-34527 also known as PrintNightmare. Both vulnerabilities can be used by an attacker with a regular user account to take control of a vulnerable server or client...

Analyzing the REvil Ransomware Attack

Over the past year, there has been a rise in extortion malware, e.g. Nefilim and Darkside, which steal and threaten to publish sensitive data or encrypt it until a ransom is paid. Nowadays, cybercriminals use various techniques to gain their initial foothold within a network in the organization...

3 things the Kaseya attack can teach us about ransomware recovery

Only rarely do companies allow us a look inside their organization while they are recovering from a ransomware attack. Many find it more convenient to keep a low profile or to be secretive. A positive exception to this is found in the Dutch managed service provider MSP VelzArt, one of the many...

Fake Kaseya VSA Security Update Drops Cobalt Strike

A malware spam campaign is milking the Kaseya ransomware attacks against its Virtual System/Server Administrator VSA platform to spread a link pretending to be a Microsoft security update, along with an executable file that’s dropping Cobalt Strike, researchers warn. On Tuesday night, Malwarebyte...

Five Common Myths about Ransom DoS Attacks

Did you know that 86% of organizations surveyed in CyberEdge’s Cyberthreat Defense Report this year were compromised by cyberattacks? Since the first known incident in 1989, ransom DoS attacks have become increasingly sophisticated over time. If you are not well versed on the potential threats th...

CISA Publishes Malware Analysis Report and Updates Alert on DarkSide Ransomware

CISA has published a new Malware Analysis Report MAR on DarkSide Ransomware and updated Alert AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks, originally released May 11, 2021. This update adds indicators of compromise associated with a...

Racing against a real-life ransomware attack, with Ski Kacoroski: Lock and Code S02E12

At 11:37 pm on the night of September 20, 2019, cybercriminals launched a ransomware attack against Northshore School District in Washington state. Early the next morning, Northshore systems administrator Ski Kacoroski arrived on scene. As Kacoroski soon found out, he and his team were on a race...

REvil ransomware actors attack Kaseya in supply chain attack

Updated on July 6, 2021: As analysis of the ransomware attack affecting organizations using Kaseya VSA has continued, we are sharing an update containing additional information. As new details are identified, this information may be updated as needed. This event consisted of two separate, but...

Kaseya Rules Out Supply-Chain Attack; Says VSA 0-Day Hit Its Customers Directly

U.S. technology firm Kaseya, which is firefighting the largest ever supply-chain ransomware strike on its VSA on-premises product, ruled out the possibility that its codebase was unauthorizedly tampered with to distribute malware. While initial reports raised speculations that REvil, the ransomwa...

Potential exposure to Kaseya VSA Agent ransomware attack

Binary data kaseyaiocjuly2021.nbin...

Kaseya Attack Fallout: CISA, FBI Offer Guidance

The REvil cybergang is taking credit for Friday’s massive ransomware attack against managed service provider Kaseya Ltd. The criminals behind the attack claim it infected 1 million systems tied to Kaseya services and are demanding $70 million in bitcoin in exchange for a decryption key. Federal...

Revil ransomware increases ransom to $70M in Kaseya attack

By Sudais Asif The Revil ransomware group has released a notice stating that more than 1 million systems have been infected - far more than initially believed. A couple of days ago, we reported on how the infamous REvil ransomware had targeted over 40 Managed Service Providers MSPs compromising...

REvil ransomware attack against MSPs and its clients around the world

An attack perpetrated by REvil aka Sodinokibi ransomware gang against Managed Service Providers MSPs and their clients was discovered on July 2. Some of the victims have reportedly been compromised through a popular MSP software which led to encryption of their customers. The total number of...

Ransomware Defense: Top 5 Things to Do Right Now

If there is any cyber-threat at the top of everyone’s mind right now, it must be ransomware. Once a “nuisance” threat, ransomware has grown into a layered, multi-billion-dollar industry for attackers. These threat actors are no longer amateurs trying their hand at breaking and entering. Rather, w...

TrickBot Botnet Found Deploying A New Ransomware Called Diavol

Threat actors behind the infamous TrickBot malware have been linked to a new ransomware strain named "Diavol," according to the latest research. Diavol and Conti ransomware payloads were deployed on different systems in a case of an unsuccessful attack targeting one of its customers earlier this...