Anatomy of a Breach

Anatomy of a Breach: Kaseya VSA — REvil's Supply Chain Ransomware Attack on 1,500 Businesses

> series: anatomy_of_a_breach —— part: 151 —— target: kaseya_vsa —— ransomware: revil —— businesses: 1,500 —— demand: $70,000,000<span class="cursor-blink">_</span>_

Hedgehog Security 31 July 2021 14 min read

One vendor. 1,500 businesses. 800 supermarkets closed. $70 million demanded.

On 2 July 2021, REvil ransomware operators exploited zero-day vulnerabilities in Kaseya VSA — a remote monitoring and management (RMM) platform used by managed service providers (MSPs) to administer their clients' IT environments. By compromising Kaseya's on-premises VSA servers, the attackers pushed ransomware through the legitimate software update mechanism to the MSPs' clients — encrypting systems at approximately 1,500 businesses in a single coordinated attack.

The most visible casualty was Coop Sweden — a supermarket chain that was forced to close approximately 800 stores because its point-of-sale systems were encrypted through its MSP's connection to Kaseya. REvil initially demanded $70 million for a universal decryptor — the largest ransomware demand in history at the time. The attack combined the supply chain compromise methodology of SolarWinds with the mass ransomware deployment of WannaCry, delivered through the trusted relationship between MSPs and their clients — the same trust model that enables managed SOC services and managed security to function.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Your IT provider's tools are your attack surface.

Supply Chain + Ransomware = Maximum Impact
Kaseya combined two of the most devastating attack methodologies: supply chain compromise (accessing clients through a trusted vendor) and ransomware (encrypting for financial extortion). The result was ransomware deployed to 1,500 businesses simultaneously through a single attack. For UK organisations using MSPs, <a href="/cyber-essentials">Cyber Essentials</a> addresses MSP security requirements.
800 Supermarkets Closed
Coop Sweden's closure of 800 stores demonstrated the cascading real-world impact of supply chain ransomware — a supermarket chain was shut down not because it was attacked, but because its MSP's software vendor was compromised. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for the anomalous software deployment patterns that indicate supply chain attacks.
RMM Tools Are God Mode
RMM tools like Kaseya VSA are designed to manage and control client systems remotely — including pushing software updates and executing commands. When compromised, they provide attackers with the same capabilities the tool provides administrators: deployment of any software to any managed endpoint. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses RMM tool security and MSP access controls.
$70 Million Demand
REvil's $70 million demand for a universal decryptor was the largest ransomware demand ever — reflecting the scale of the attack (1,500 businesses). Shortly after the attack, REvil's infrastructure went offline, and in October 2021, Kaseya obtained a universal decryptor — reportedly through FBI intervention. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> coordinates with law enforcement during major ransomware incidents.

Trust your MSP — but verify their security.

The Kaseya attack demonstrated that the trust relationship between organisations and their MSPs — while necessary — creates supply chain risk that must be managed. For UK organisations using managed IT services, the MSP's own security posture, the tools they use, and the access they have to your systems must be assessed as part of your security programme. Cyber Essentials addresses MSP security. Our infrastructure testing includes assessment of MSP access controls and RMM tool security. SOC in a Box monitors for supply chain indicators independently of your MSP. And UK Cyber Defence provides incident response when supply chain attacks affect your organisation.


Kaseya: one vendor, 1,500 businesses, 800 supermarkets closed. How much access does your MSP have?

Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses MSP access and RMM security. <a href="/cyber-essentials">Cyber Essentials</a> addresses MSP requirements. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors independently of your MSP.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles