Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Kaseya VSA Ransomware Attack

Summary: On July 2, attackers used access to Kaseya VSA remote monitoring and management software to deploy REvil/Sodinokibi ransomware against VSA users and customers of multiple managed service providers, exploiting a vulnerability Kaseya has not detailed and is still patching. Kaseya said fewer than 40 of its customers were impacted and recommended all VSA users shut the system down immediately, while CISA issued a bulletin endorsing that guidance; the full extent of the attack is unknown.

What's compelling: Kaseya's count of fewer than 40 affected customers understates the exposure, because if any of those customers are MSPs, an attacker with control of an MSP's VSA system could push malware into every network that MSP manages.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related