2021RansomwareSupply chainVulnerability exploitation
Kaseya VSA supply-chain ransomware attack
2 July 2021
Attackers exploited vulnerabilities in on-premises installations of Kaseya VSA, remote monitoring and management software used by managed service providers, and pushed REvil ransomware through it to the MSPs' customers. Kaseya shut down its SaaS servers and told on-premises customers to shut down their VSA servers until a patch was released.
- Victim
- Managed service providers using Kaseya VSA on-premises, and their customers
- Sector
- IT services and downstream businesses
- Public attribution
- The US Department of Justice charged a Ukrainian national, alleging he deployed REvil ransomware in the Kaseya attack.
- Malware
- REvil
Impact
Many businesses downstream of affected MSPs had systems encrypted; CISA described the risk of globally cascading effects from MSP compromises.
Root cause
Vulnerabilities in an internet-facing remote management tool that had privileged access to every managed endpoint.
Lessons learned: the controls it teaches
- Treat RMM tools as tier-0: restrict access with allowlists or VPN, and enforce MFA.
- Ask MSPs how they secure the tools that reach your network.
- Keep offline backups that an MSP compromise cannot reach.