incident · 1625184000000

Kaseya VSA Supply-Chain Ransomware Attack

The REvil ransomware group exploited a vulnerability in Kaseya VSA software to deploy ransomware to managed service providers (MSPs) and their downstream customers globally.

What happened

On July 2, 2021, the REvil ransomware group launched a massive supply-chain attack by exploiting a zero-day vulnerability in Kaseya VSA, a remote monitoring and management (RMM) tool used by managed service providers (MSPs). The attackers pushed a malicious update through the VSA servers, which deployed ransomware to the endpoints of the MSPs' customers. Kaseya quickly shut down its SaaS servers and advised on-premises customers to do the same to halt the spread. Approximately 50 MSPs and up to 1,500 downstream businesses were affected globally.

Technical mechanism

Attackers exploited an authentication bypass and command injection vulnerability (CVE-2021-30116) in Kaseya VSA's web interface. This allowed them to execute arbitrary commands and deploy a malicious payload (a fake Windows Defender update containing the REvil encryptor) to managed endpoints.

Why it matters

This incident demonstrated the devastating scale of supply-chain attacks, where compromising a single trusted software vendor (Kaseya) allowed attackers to simultaneously infect thousands of downstream organizations.

Impact

The attack encrypted data for up to 1,500 organizations worldwide, causing significant business disruptions, particularly for small and medium-sized businesses reliant on MSPs. REvil initially demanded a $70 million universal decryptor key.

Response

Kaseya shut down its cloud infrastructure and urged on-premises customers to disconnect VSA servers. CISA and the FBI issued joint guidance for affected MSPs. On July 21, Kaseya obtained a universal decryptor key from an unnamed third party, enabling victims to recover their data.

Defensive lessons

  • Organizations must rigorously assess the security posture of their managed service providers and third-party software vendors.
  • MSPs must implement stringent security controls, including MFA, allowlisting, and network segmentation for administrative interfaces.
  • Rapid communication and coordinated shutdown procedures can limit the blast radius of supply-chain attacks.

Evidence register

  1. Cybersecurity and Infrastructure Security Agency (CISA) — CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack (verified)