REvil Attacked 1,000+ Companies In Supply-Chain Attack

Share post:

A massive ransomware attack by REvil has affected several managed service providers and over a thousand of their customers through a reported Kaseya supply chain attack, which was allegedly committed by the REvil ransomware gang alias Sodinokibi.

Kaseya VSA is a cloud-based MSP platform that enables vendors to perform patch management and client monitoring for their customers.

John Hammond of Huntress Labs mentioned that all affected MSPs use Kaseya VSA and that they have evidence that their customers are also encrypted.

Kaseya has posted a security advisory on its helpdesk page warning all VSA customers to immediately shut down their VSA server to prevent the spread of the attack while investigations are ongoing.

Most large-scale ransomware attacks are carried out late at night over the weekend when less staff are available to monitor the network.

Threat actors probably planned the timing to coincide with the Fourth of July weekend in the U.S., where it is common for employees to have a shorter working day before the holidays.

The ransomware gang demanded a ransom of $5 million in exchange for a decryptor from one of the samples.

MSP customers affected by the attack received a significantly lower ransom of $44,999.

Although REvil is known to steal data before the ransomware is deployed and devices are encrypted, it is not known whether the attackers have exfiltrated any files.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

Exim issues email server update, mitigations for 6 zero-day vulnerabilities

All previous versions of Exim are obsolete, the developers warn admi

Cyber Security Today, Oct. 2, 2023 – How to create a cybersecurity awareness program

For October Cyber Security Awareness Month this episode offers tips on how to build an effective awarene

Cyber Security Today, Oct. 2, 2023 – How to create a cybersecurity awareness program

For October Cyber Security Awareness Month this episode offers tips on how to build an effective awarene

Cyber Security Today, Week in Review for the week ending Friday, Sept. 29, 2023

This episode features discussion on October Security Awareness Month, ransomware, teenage hackers and the start of hearings into proposed Canadian privacy a

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways