Kaseya REvil Ransomware Attack (CVE-2021-30116) – Automatically Discover and Prioritize Using Qualys VMDR® | Qualys

Summary: On July 2, 2021, Kaseya announced its software had been compromised and was being used to attack customer IT infrastructure, with REvil operators exploiting zero-day CVE-2021-30116 in the VSA product to deploy ransomware. REvil, a ransomware-as-a-service operation also known as Sodinokibi, demanded $70 million for a universal decryptor and claimed on its dark web blog to have locked more than one million systems, while CISA and the FBI published an advisory and urged use of Kaseya's VSA Detection Tool.
What's compelling: A single compromised management tool reached supermarket chains in Sweden, kindergartens in New Zealand, and public administration offices in Romania, and the attacker's own claim of over one million locked systems shows how far trust in one vendor's software can carry an intrusion.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-30116
Related: CVE-2021-30116: Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026