Kaseya’s REvil Ransomware Attack Hits 40 Customers worldwide & Hackers Ask’s $70 Million

Recently a cyberattack hit the American MSP provider Kaseya, and the experts have claimed that this attack is one of the largest in the history of ransomware attacks.

The attackers behind this incident, which affected hundreds of companies using Kaseya software, is the ransomware group “REvil.” And not only that even to provide a universal decryptor the operator of REvil has demanded $70 million in bitcoins to unlock all the encrypted systems.

REvil Ransomware also known as Sodinokibi observed wild at the end of April 2019. The REvil ransomware is a part of Ransomware-as-a-Service (RaaS) where a set of people maintain the source code and other affiliate groups distribute the ransomware.

Apart from this, more than 1 million systems were infected with this ransomware, as the hackers have claimed on their darknet portal. It was assumed initially that operators of REvil ransomware could gain access to the Kaseya backend infrastructure.

Currently, it is not known for sure how this attack is being carried out, but it appears to be affecting both Kaseya and its 40 Customers along with their clients worldwide.

However, the experts estimated that the hackers will do so to distribute the malicious update and install the ransomware on VSA servers running on the networks of the company’s customers.

But, the researchers at Dutch non-profit organization DIVD affirmed the hackers exploited an unknown 0-day vulnerability in the Kaseya VSA server.

Once the server is infected, the malware shuts down administrative access and begins encrypting data, the precursor to the full ransomware attack cycle. Once the encryption process is complete, the system’s desktop wallpaper is set as follows.

Further information

The head of the DIVD, Victor Gevers asserted that when Kaseya was attacked at that time Kaseya was in the process of patching a 0-day (CVE-2021-30116) vulnerability.

Moreover, the head of DIVD, Victor Gevers refused to disclose any further details regarding the vulnerability. But, the first entity that reported this incident, Huntress Labs noted that this vulnerability is about an authentication bypass vulnerability in the VSA web interface.

Here they claimed that the hackers executed SQL commands on the VSA devices to install ransomware on all connected clients by using the bypass the authorization on the VSA web panel.

Ransomware Gang Demand $70 Million Ransom

Early last month REvil extorted $11 million from the meat-processor JBS, and since April 2019 REvil is active. And now for a universal decryptor, the hackers have asked Kaseya $70 million as a ransom payment.

According to the reports, this hefty ransom amount is the biggest ransom payment ever demanded by any ransomware operator..

However, the company stated that it has identified the vulnerability and is preparing a fix, and not only this, even they have also provided a new tool known as Compromise Detection Tool to check servers for hacks to all its customers.

While apart from this, over the weekend the researcher at ESET has recorded a record swell in infections with the REvil ransomware, and they associate this with the Kaseya incident.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.