President Joe Biden said he’s ordered U.S. intelligence agencies to investigate the REvil ransomware campaign that affected at least 200 organizations using the Kaseya VSA platform.
The Guardian reported that Biden’s hoping to learn if the Russian government is involved with the attack. “The initial thinking was it was not the Russian government but we’re not sure yet,” he said, adding that the U.S. will be prepared to respond if the attack is later attributed to Russia.
News of REvil’s campaign broke on July 2 as people throughout the U.S. prepared to celebrate Independence Day. Kaseya said it was investigating a potential attack on its VSA service, which enables remote software management, believed to have affected 40 of its customers.
But the ransomware quickly spread from there. Huntress Labs said at least 200 organizations were affected by the campaign as it spread from Kaseya’s customers to other groups. Kaseya then said in a July 3 update that its VSA service was indeed compromised as part of this attack.
“We have been advised by our outside experts,” the company said in the update, “that customers who experienced ransomware and receive communication from the attackers should not click on any links – they may be weaponized.”
Kaseya told The Guardian that the attack only affected on-premise VSA installations; the company’s hosted offering appeared to be unaffected. Yet the scope of this campaign has reportedly left hundreds of companies unable to access critical systems until the issue is fixed.
