REvil’s latest ransomware campaign demonstrates the domino effect of security incidents by initially targeting an IT management solutions provider called Kaseya, spreading to Kaseya’s customers, and then expanded from there to affect at least 200 companies in total.
Kaseya acknowledged the attack on July 2. The company said it immediately shut down its software-as-a-service (SaaS), notified on-premises customers, reached out to “leading industry experts in forensic investigations,” and informed cybersecurity agencies about the campaign.
The campaign seems fairly standard: BleepingComputer reported that the ransomware spread via Kaseya VSA, encrypted the contents of affected systems, and then demanded a ransom. (At least one victim was asked for $5 million; others may have been asked for different amounts.)
Kaseya said the number of affected customers was “currently estimated at fewer than 40 worldwide” as of July 2. But its customers weren’t the only ones targeted by the campaign, and the Huntress Labs cybersecurity firm told NBC News at least 200 organizations were affected.
Huntress Labs has also shared additional information about the attack on Reddit. “Based on the forensic patterns, ransomware notes and the TOR URL,” the company said, “we strongly believe a REvil/Sodinokibi [ransomware-as-a-service] affiliate is behind these intrusions.”
Kaseya has reportedly prepared a patch for VSA that’s expected to remove the vulnerability exploited by this campaign. It’s currently testing the patch to ensure it’s effective, according to BleepingComputer, before releasing it to customers who host VSA on-premises.
But it might take a while for affected businesses to install that patch or recover their files. The attack happened just before Independence Day in the U.S. Many companies give employees long weekends to celebrate the holiday, which will limit their ability to respond to this incident.
