REvil Attacked 1,000+ Companies In Supply-Chain Attack

Share post:

A massive ransomware attack by REvil has affected several managed service providers and over a thousand of their customers through a reported Kaseya supply chain attack, which was allegedly committed by the REvil ransomware gang alias Sodinokibi.

Kaseya VSA is a cloud-based MSP platform that enables vendors to perform patch management and client monitoring for their customers.

John Hammond of Huntress Labs mentioned that all affected MSPs use Kaseya VSA and that they have evidence that their customers are also encrypted.

Kaseya has posted a security advisory on its helpdesk page warning all VSA customers to immediately shut down their VSA server to prevent the spread of the attack while investigations are ongoing.

Most large-scale ransomware attacks are carried out late at night over the weekend when less staff are available to monitor the network.

Threat actors probably planned the timing to coincide with the Fourth of July weekend in the U.S., where it is common for employees to have a shorter working day before the holidays.

The ransomware gang demanded a ransom of $5 million in exchange for a decryptor from one of the samples.

MSP customers affected by the attack received a significantly lower ransom of $44,999.

Although REvil is known to steal data before the ransomware is deployed and devices are encrypted, it is not known whether the attackers have exfiltrated any files.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday April 19, 2024

On this episode Jen Ellis, co-chair of the Ransomware Task Force, talks about ways of fighting one of the biggest cyber threats to IT d

Cyber Security Today, April 19, 2024 – Police bust phishing rental platform, a nine-year old virus found on Ukrainian computers, and more

This episode reports on a threat actor targeting governments in the Middle East with a novel way of hiding malware is going international

Controversial expansion of US surveillance powers nears Senate vote

The US Senate is poised to vote on a significant expansion of Section 702 of the Foreign Intelligence...

Russian-linked hackers target U.S. and European water systems

A Russian military-affiliated hacking group, Sandworm, is suspected of coordinating recent cyberattacks on water utilities in the U.S.,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways