Threat Source newsletter (July 8, 2021)
Summary: Cisco Talos reported that attackers are actively exploiting Kaseya VSA endpoint monitoring software through a malicious automatic update to conduct a widespread supply chain attack on Managed Service Providers, delivering REvil/Sodinokibi ransomware that encrypts systems and writes a text-based README ransom note into directories. Separately, a threat actor is using leaked Babuk ransomware builder code, uploaded to VirusTotal, to create customized encryptors and decryptors targeting Windows, VMware ESXi, NAS x86 and NAS ARM devices, misspelling Babuk in its ransom note and requesting only $210.
Why it matters: REvil operates as a ransomware-as-a-service model in which affiliates infect victims and coerce payment, and backup servers are often targeted in these network-based attacks, so an offline backup and recovery strategy that is regularly tested is the difference between a disruption and a recovery.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026