Vulnerabilities On 23 March 2021,
Dutch Institute for Vulnerability Disclosure (DIVD) researcher Wietse Boonstra found six
zero-day vulnerabilities in Kaseya VSA (Virtual Systems Administrator), and found another on 2 April. The DIVD contacted Kaseya on 6 April and worked together with company experts to resolve four of the seven reported vulnerabilities. The DIVD later wrote a blog post about finding the zero-days.
Attack and response Despite the advance warning from DIVD, Kaseya did not patch all the reported bugs before they were exploited by REvil to deploy ransomware. An authentication bypass
vulnerability in the software allowed attackers to compromise VSA on 2 July and distribute a malicious payload through hosts managed by the software, amplifying the reach of the attack. In response, the company shut down its VSA
cloud and
SaaS servers and issued a security advisory to customers, including those with
on-premises deployments of VSA. Initial reports of companies affected by the incident included Norwegian financial software developer
Visma, who manages some systems for Swedish supermarket chain
Coop. The supermarket chain had to close down its 800 stores for almost a week, some in small villages without any other food shop. They did not pay ransom, but rebuilt their systems from scratch after waiting for an update from Kaseya. The
REvil ransomware gang officially took credit for the attack and claimed to have encrypted more than one million systems during the incident. On 5 July 2021, REvil announced that they would release a universal decryptor, which would unlock all affected systems, in exchange for a 70 million USD ransom payment paid in
Bitcoin. Also on 5 July, Kaseya said that between 800 and 1,500 downstream businesses were impacted in the attack. Along with Coop, impacted organizations included schools in New Zealand, companies in Germany and the United States, and a town in Maryland. On 4 July 2021, the U.S. Deputy National Security Advisor for Cyber and Emerging Technology,
Anne Neuberger, stated that the U.S.
Federal Bureau of Investigation (FBI) and
Cybersecurity and Infrastructure Security Agency (CISA) were providing assistance to Kaseya and impacted customers. After a 9 July 2021 phone call between United States president
Joe Biden and Russian president
Vladimir Putin, Biden told the press, "I made it very clear to him that the United States expects when a ransomware operation is coming from his soil even though it's not sponsored by the state, we expect them to act if we give them enough information to act on who that is." Biden later added that the United States would take the group's servers down if Putin did not. CISA released incident response guidance for affected customers on 12 July 2021. On 13 July 2021, REvil websites and other infrastructure vanished from the internet, although they later returned.
Recovery On 23 July, Kaseya announced it had received a universal decryptor key for the REvil-encrypted files from an unnamed "trusted third party" and was helping victims restore their files. Kaseya worked with
Emsisoft to create a decryption tool for customers using the key. In September 2021, the
Washington Post reported that the master key came from the FBI, which had secretly obtained the key earlier. == Legal action ==