Approximatively 1,500 businesses impacted by Kaseya attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30116 | Credential Disclosure via Unauthenticated Download Page in Kaseya VSA Kaseya VSA before 9.5.7 exposes an unauthenticated client download page (/dl.asp) that leaks agent credentials: the Windows agent stores an Agent_Guid and AgentPassword in KaseyaD.ini, and supplying these to dl.asp via GET parameters authenticates the requester and returns a sessionId cookie. That sessionId can then be used to bypass authentication against services not intended for agent use, and anyone who obtains KaseyaD.ini from a managed endpoint gains enough information to penetrate the VSA installation and its managed clients. On-premises VSA deployments are affected by default, since the vulnerable download page is part of the standard installation. The flaw was exploited in the wild in July 2021 as part of the REvil ransomware campaign against Kaseya VSA, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and carries a very high EPSS of 85.7%. Do: Upgrade Kaseya VSA to 9.5.7 or later per vendor instructions, as required by CISA's KEV catalog. Restrict internet access to the VSA download page (/dl.asp) or disable the agent-login capability there until patched, and review logs for dl.asp GET requests carrying agent credentials (un/pw parameters) or sessionId-based access to services not intended for agent use. Given known ransomware use, treat any unpatched, internet-exposed VSA server as high risk and check managed endpoints for exposed KaseyaD.ini credential material. | 9.8 | 86% | KEV ransomware PoC |
| mass≈40,000 VSA deployments (Kaseya reported ~40,000 customers, mostly MSPs) managing millions of downstream endpoints |
Full article395 words · extracted from securityaffairs.com · click to collapse
Kaseya confirmed that the REvil supply-chain ransomware attack hit fewer than 60 of its customers and their customers.
Software provider Kaseya announced that fewer than 60 of its customers and less than 1,500 businesses have been impacted by the recent supply-chain ransomware attack.
Up to 1,500 downstream organizations, which were customers of MSPs using Kaseya VSA management platform, were impacted by the attack.
“While impacting approximately 50 of Kaseya’s customers, this attack was never a threat nor had any impact to critical infrastructure. Many of Kaseya’s customers are managed service providers, using Kaseya’s technology to manage IT infrastructure for local and small businesses with less than 30 employees, such as dentists’ offices, small accounting offices and local restaurants. Of the approximately 800,000 to 1,000,000 local and small businesses that are managed by Kaseya’s customers, only about 800 to 1,500 have been compromised.” reads a statement published by the company.
On Friday the REvil ransomware gang hit the Kaseya cloud-based MSP platform impacting MSPs and their customers.
The REvil ransomware operators initially compromised the Kaseya VSA’s infrastructure, then pushed out malicious updates for VSA on-premise servers to deploy ransomware on enterprise networks.
The ransomware gang exploited a zero-day vulnerability in Kaseya VSA servers, tracked as CVE-2021-30116, that was discovered by The Dutch Institute for Vulnerability Disclosure (DIVD) and reported to the company.
Kaseya was validating the patch before they rolled it out to customers but REvil ransomware operators exploited the flaw in the massive supply chain ransomware attack.
REvil ransomware is asking $70 million worth of Bitcoin for decrypting all systems impacted in the Kaseya supply-chain ransomware attack.
At the time of this writing, only five MSPs have publicly disclosed the security breach caused by the supply chain attack on Kaseya VSA servers, they are Avtex, Hoppenbrouwers, Synnex, Visma EssCom, and VelzArt.
CISA and the Federal Bureau of Investigation (FBI) have published guidance for the organizations impacted by the massive REvil supply-chain ransomware attack that hit Kaseya ‘s cloud-based MSP platform.
The US agencies provide instructions to affected MSPs and their customers on how to check their infrastructure for indicators of compromise.
Kaseya has released a detection tool that could be used by organizations to determine if your infrastructure has been compromised.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, REVIL)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/119759/cyber-crime/kaseya-attack-impacted-1500-businesses.html