Ransomwarecritical
REvil ransomware actors attack Kaseya in supply chain attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-30116 | Credential Disclosure via Unauthenticated Download Page in Kaseya VSA | 9.8 | 86% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd | execution of the DLL in the wild occurred at 12:30:24 EDT. (8DD620D9AEB35960BB766458C8890EDE987C33D239CF730F93FE49D90AE759DD) A Reddit thread was posted around 12:30 ET. Reports began |
| sha256 | d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e | he dropper mechanism in the wild occurred at 12:26:00 EDT. (D55F983C994CAA160EC63A59F6B4250FE67FB3E8C43A388AEC60A4A6978E9F1E) Gen:Variant.Graftor.952042 was first detected on July 2, 2 |
| sha256 | e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 | 83c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae |
From the original article
5 min read at blog.talosintelligence.com
As analysis of the ransomware attack affecting organizations using Kaseya VSA has continued, we are sharing an update containing additional information. As new details are identified, this information may be updated as needed. This event consisted of two separate, but related incidents.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.