Kaseya VSA Ransomware July 2021
Channel: Lawrence Systems
Date: 2021-07-06

One thing of note is that while CVE-2021-30116 appears to have been part of the attack, there were other vulnerabilities that neither Kaseya or anyone else besides the threat actors were aware of prior to July 2nd 2021 that were used in this attack.  Huntress put on a webinar today July 6th 2021 (after I published this video) and offered up a demo using proof of concept code they wrote to prove how the attack worked and it did require more than what was outlined in the CVE-2021-30116.  Here is the PoC https://twitter.com/calebjstewart/status/1412546446734282753


Huntress Blog Post
https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

Kaseya Incident Overview & Technical Details
https://helpdesk.kaseya.com/hc/en-gb/articles/4403584098961
Kaseya Vulnerability Disclosure Policy
(They make a point they are NOT currently participating in a bug bounty program)
https://www.kaseya.com/legal/vulnerability-disclosure-policy/

Victors Tweet
https://twitter.com/0xDUDE/status/1411146581840207873

Darknet Diaries EP 87: GUILD OF THE GRUMPY OLD HACKERS
https://darknetdiaries.com/episode/87/
Darknet Diaries EP 88: VICTOR
https://darknetdiaries.com/episode/88/

ConnectWise Control: Vulnerabilities & Responsible Disclosure By Bishop Fox and Huntress Labs
https://youtu.be/MIJAj3SvVMM

The Solarwinds Orion SUNBURST Attack Timeline 
https://youtu.be/Sphqregsss4

Connecting With Us
---------------------------------------------------  
+ Hire Us For A Project: https://lawrencesystems.com/hire-us/
+ Tom Twitter 🐦 https://twitter.com/TomLawrenceTech
+ Our Web Site https://www.lawrencesystems.com/
+ Our Forums https://forums.lawrencesystems.com/
+ Instagram https://www.instagram.com/lawrencesystems/
+ Facebook https://www.facebook.com/Lawrencesystems/
+ GitHub https://github.com/lawrencesystems/
+ Discord https://discord.gg/ZwTz3Mh

Lawrence Systems Shirts and Swag
---------------------------------------------------
►👕 https://lawrence.video/swag


AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store
🛒 https://www.amazon.com/shop/lawrencesystemspcpickup

All Of Our Affiliates that help us out and can get you discounts!
🛒 https://www.lawrencesystems.com/partners-and-affiliates/

Gear we use on Kit 
🛒 https://kit.co/lawrencesystems

Use OfferCode LTSERVICES to get 5% off your order at
🛒 https://lawrence.video/techsupplydirect

Digital Ocean Offer Code
🛒 https://m.do.co/c/85de8d181725

HostiFi UniFi Cloud Hosting Service
🛒 https://hostifi.net/?via=lawrencesystems

Protect you privacy with a VPN from Private Internet Access
🛒 https://www.privateinternetaccess.com/pages/buy-vpn/LRNSYS

Patreon
💰 https://www.patreon.com/lawrencesystems

#Kaseya #Ransomware #CVE-2021-30116