REvil ransomware gang demanded $70M for universal decryptor for Kaseya victims
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30116 | Credential Disclosure via Unauthenticated Download Page in Kaseya VSA Kaseya VSA before 9.5.7 exposes an unauthenticated client download page (/dl.asp) that leaks agent credentials: the Windows agent stores an Agent_Guid and AgentPassword in KaseyaD.ini, and supplying these to dl.asp via GET parameters authenticates the requester and returns a sessionId cookie. That sessionId can then be used to bypass authentication against services not intended for agent use, and anyone who obtains KaseyaD.ini from a managed endpoint gains enough information to penetrate the VSA installation and its managed clients. On-premises VSA deployments are affected by default, since the vulnerable download page is part of the standard installation. The flaw was exploited in the wild in July 2021 as part of the REvil ransomware campaign against Kaseya VSA, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and carries a very high EPSS of 85.7%. Do: Upgrade Kaseya VSA to 9.5.7 or later per vendor instructions, as required by CISA's KEV catalog. Restrict internet access to the VSA download page (/dl.asp) or disable the agent-login capability there until patched, and review logs for dl.asp GET requests carrying agent credentials (un/pw parameters) or sessionId-based access to services not intended for agent use. Given known ransomware use, treat any unpatched, internet-exposed VSA server as high risk and check managed endpoints for exposed KaseyaD.ini credential material. | 9.8 | 86% | KEV ransomware PoC |
| mass≈40,000 VSA deployments (Kaseya reported ~40,000 customers, mostly MSPs) managing millions of downstream endpoints |
Full article553 words · extracted from securityaffairs.com · click to collapse
REvil ransomware is demanding $70 million for decrypting all systems locked during the Kaseya supply-chain ransomware attack.
REvil ransomware is asking $70 million worth of Bitcoin for decrypting all systems impacted in the Kaseya supply-chain ransomware attack.
On Friday the REvil ransomware gang hit the Kaseya cloud-based MSP platform impacting MSPs and their customers.
The REvil ransomware operators initially compromised the Kaseya VSA’s infrastructure, then pushed out malicious updates for VSA on-premise servers to deploy ransomware on enterprise networks.
The investigation is still ongoing, according to security firm Huntress Labs at least 1000 organizations have been impacted, making this incident, one of the largest ransomware attacks in history.
The situation could be worse, according to a message shared by the group on its leak site, the gang claims to have encrypted files on more than a million systems and offers a way out for a universal descriptor.
“On Friday (02.07.2021) we launched an attack on MSP providers. More than a million systems were infected. If anyone wants to negotiate about universal decryptor – our price is 70 000 000$ in BTC and we will publish publicly decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour. If you are interested in such deal – contact us using victims “readme” file instructions.” reads the message on its leak site.
REvil ransomware initially asked the owners of endpoints infected in this campaign 44,999 USD in Bitcoin, but now it seems to be interested to close the game with a single huge ransom of $70 million.
Bleeping computer pointed out that the group used multiple extensions when encrypting the files and that it is requesting 44,999 USD only for one of them.
“For victims with locked files that have multiple extensions following the REvil ransomware encryption, the gang’s demand can be as high as $500,000, BleepingComputer learned.” reported BleepingComputer.
The ransomware gang exploited a zero-day vulnerability in Kaseya VSA servers, tracked as CVE-2021-30116, that was discovered by The Dutch Institute for Vulnerability Disclosure (DIVD) and reported to the company.
Kaseya was validating the patch before they rolled it out to customers but REvil ransomware operators exploited the flaw in the massive supply chain ransomware attack.
“From our side, we would like to mention Kaseya has been very cooperative. Once Kaseya was aware of our reported vulnerabilities, we have been in constant contact and cooperation with them. When items in our report were unclear, they asked the right questions. Also, partial patches were shared with us to validate their effectiveness. During the entire process, Kaseya has shown that they were willing to put in the maximum effort and initiative into this case both to get this issue fixed and their customers patched. They showed a genuine commitment to do the right thing.” states an update provided by the Dutch Institute for Vulnerability Disclosure (DIVD). “Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch.”
US authorities are investigating the incident and U.S. President Biden is urging them into providing a clear picture of what has happened.
Below my interview on the Case:
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Kaseya)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/119709/cyber-crime/revil-ransomware-kaseya-decryptor.html