REvil ransomware actors attack Kaseya in supply chain attack
Summary: Attackers exploited Kaseya VSA endpoint monitoring software through a malicious automatic update to conduct a supply chain attack on Managed Service Providers, delivering REvil/Sodinokibi ransomware that encrypted systems and disrupted operations. Cisco Talos noted organizations using Kaseya VSA may have been compromised even without a successful ransomware deployment, and that backup servers are often targeted in such attacks.
Bottom line: Kaseya's own guidance was to immediately shut down VSA servers because one of the attacker's first actions is to cut off administrative access - meaning the tool you use to manage customer environments can be turned against you before you can respond.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026