> series: anatomy_of_a_breach —— part: 151 —— target: kaseya_vsa —— ransomware: revil —— businesses: 1,500 —— demand: $70,000,000<span class="cursor-blink">_</span>_
On 2 July 2021, REvil ransomware operators exploited zero-day vulnerabilities in Kaseya VSA — a remote monitoring and management (RMM) platform used by managed service providers (MSPs) to administer their clients' IT environments. By compromising Kaseya's on-premises VSA servers, the attackers pushed ransomware through the legitimate software update mechanism to the MSPs' clients — encrypting systems at approximately 1,500 businesses in a single coordinated attack.
The most visible casualty was Coop Sweden — a supermarket chain that was forced to close approximately 800 stores because its point-of-sale systems were encrypted through its MSP's connection to Kaseya. REvil initially demanded $70 million for a universal decryptor — the largest ransomware demand in history at the time. The attack combined the supply chain compromise methodology of SolarWinds with the mass ransomware deployment of WannaCry, delivered through the trusted relationship between MSPs and their clients — the same trust model that enables managed SOC services and managed security to function.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Kaseya attack demonstrated that the trust relationship between organisations and their MSPs — while necessary — creates supply chain risk that must be managed. For UK organisations using managed IT services, the MSP's own security posture, the tools they use, and the access they have to your systems must be assessed as part of your security programme. Cyber Essentials addresses MSP security. Our infrastructure testing includes assessment of MSP access controls and RMM tool security. SOC in a Box monitors for supply chain indicators independently of your MSP. And UK Cyber Defence provides incident response when supply chain attacks affect your organisation.
Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses MSP access and RMM security. <a href="/cyber-essentials">Cyber Essentials</a> addresses MSP requirements. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors independently of your MSP.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call