Kaseya Gets Universal Decryptor to Help REvil Ransomware Victims

News

Nearly three weeks after Florida-based software vendor Kaseya was hit by a widespread supply-chain ransomware attack, the company on Thursday said it obtained a universal decryptor to unlock systems and help customers recover their data.

Stack Overflow Teams

“On July 21, Kaseya obtained a decryptor for victims of the REvil ransomware attack, and we’re working to remediate customers impacted by the incident,” the company said in a statement. “Kaseya obtained the tool from a third-party and have teams actively helping customers affected by the ransomware to restore their environments, with no reports of any problem or issues associated with the decryptor.”

It’s not immediately unclear if Kaseya paid any ransom. It’s worth noting that REvil affiliates had demanded a ransom of $70 million — an amount that was subsequently lowered to $50 million — but soon after, the ransomware gang mysteriously went off the grid, shutting down their payment sites and data leak portals.

The incident is believed to have infiltrated as many as 1,500 networks that relied on 60 managed service providers (MSPs) for IT maintenance and support using Kaseya’s VSA remote management product as an ingress point for what has turned out to be one of the “most important cybersecurity event of the year.”

Enterprise Password Management

Kaseya has since released patches for the zero-days that were exploited to gain access to Kaseya VSA on-premise servers, using the foothold to pivot to other machines managed through the VSA software and deploy a version of the REvil ransomware.

The fallout from the attack, waged through a breach in the software supply chain, has raised new concerns about how threat actors are increasingly abusing the trust associated with third-party software to install malware, not to mention underscore the swift damage caused by ransomware attacks on trusted supply-chain providers, paralyzing hundreds of small and medium-sized businesses and causing havoc at scale with just one exploit.

Products You May Like

Articles You May Like

Don’t become a statistic: Tips to help keep your personal data off the dark web
Month in security with Tony Anscombe – October 2024 edition
Sophos Warns Chinese Hackers Are Becoming Stealthier
Stop LUCR-3 Attacks: Learn Key Identity Security Tactics in This Expert Webinar
UK Council Sites Recover Following Russian DDoS Blitz

Leave a Reply

Your email address will not be published. Required fields are marked *