Kaseya VSA ransomware attack (2021)

Date 	The attack took place on 2nd July 2021.RBS, ‘The Kaseya Attack: Everything to Know’, Risk Based Security (12 July 2021)
Suspected actor	REvil (i.e., Ransomware EvilLucian Constantin, ‘REvil ransomware explained: A widespread extortion operation’, CSO Online (17 November 2020)) group, which is also known as Sodinokibi.Cahrlie Osborn, ‘Updated Kaseya ransomware attack FAQ:What we know now’, ZDNet, (23 July 2021) It is a Russian speaking and Russia-based Ransomware as-a-service (RaaS) gang. Moreover, according to Lawfare, "It really is the McDonald's of the criminal world with a very high profile".Nicolas Weaver, ‘What Happened in the Kaseya VSA Incident?’, Lawfare (4 July 2021)
Target 	Kaseya, a global IT infrastructure provider.
Target systems 	In general, the target systems were using Virtual System Administrator (VSA) software. The reason why Kaseya VSA was an attractive target is that this software is used by managed service providers (MSP), which includes thousands of small businesses.Davey Winder, ‘$70 Million Demanded As REvil Ransomware Attackers Claim 1 Million Systems Hit’, Forbes (5 July 2021)
Method 	The attack was first detected as a supply chain attack. This idea was supported by US Cybersecurity and Infrastructure Security Agency and the FBI.‘CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack’ (4 July 2021) Nevertheless, a question arose later whether Kaseya was not facing a more conventional exploit attack targeting Kaseya VSA,RBS, ‘Is the Kaseya Hack Actually a Supply Chain Attack?, Risk Based Security’ (14 July 2021) as it was not clear if the aimed upstream (VSA) was targeted for purpose of scaling downstream exploitation or not. Nevertheless, the conclusion was that it was a supply chain attack.Matt Howard, ‘Kaseya Ransomware: a Software Supply Chain Attack or Not?’, sonatype (6 July 2021)
Purpose 	Primarily causing economic loss to Kaseya and its customers.Alex Marquardt, ‘Ransomware group demands $70 million for Kaseya attack’, CNN (5 July 2021) REvil in a post on their leak site announced that the universal decryption key was worth $70 million in BTC. This amount was the highest ransom demand to date.Ionut Ilascu, ‘REvil ransomware asks $70 million to decrypt all Kaseya attack victims’, BleepingComputer (5 July 2021)
Result 	According to Reuters, between 800 and 1500 businesses worldwide were affected by the attack.Raphael Satter, ‘Up to 1,500 businesses affected by ransomware attack, U.S. firm’s CEO says’, Reuters ( 6 July 2021) One of the victims is also Coop, a Swedish chain of supermarkets, which was forced to close over more than half of its stores in Sweden.Joe Tidy, ‘Swedish Coop supermarkets shut due to US ransomware cyber-attack’, BBC (3 July 2021) Moreover, the ransomware attack also hit 11 schools in New Zealand.‘Worldwide ransomware attack: St Peter’s College and 10 other schools hit by US cyber attack’, NZHerald (4 July 2021)
Aftermath 	On 23 July, Kaseya announced it had received a universal decryptor tool for the REvil-encrypted files from an unnamed "trusted third party" and was helping victims restore their files.Joe Tidy, ‘Ransomware key to unlock customer data from REvil attack’, BBC (23 July 2021)
It is interesting that this was a universal decryptor key. This situation was explained by REvil on 9 September in an illicit Russian-language forum as “One of our coders misclicked and generated a universal key, and issued the universal decryptor key along with a bunch of keys for one machine. That’s how we sh*t ourselves.”Michael Novinson, ‘REvil: We Accidentally Leaked Kaseya Universal Decryptor Key’,  CRN (10 September 2021)
On 8 November 2021, the US Department of Justice announced the indictment of Yaroslav Vasinskyi, an Ukrainian national detained in Poland in October,Mitchell Clark, ‘An alleged member of the REvil ransomware gang has been arrested in Poland’, The Verge (8 November 2021) charged for allegedly deploying the REvil ransomware attack against Kaseya.US Department of Justice, ‘Ukrainian Arrested and Charged with Ransomware Attack on Kaseya’, Press Release (8 November 2021); Ryan Gallagher and Jack Gillum, ‘Police Arrest Five Members Tied to the REvil Ransomware Gang’, Bloomberg (8 November 2021) In addition, in January 2022, Russia’s Federal Security Service arrested 14 alleged members of the REvil gang.Kevin Collier, ‘Russia arrests ransomware gang responsible for high-profile cyberattacks’, NBC News (14 January 2022) The authorities claim to have dismantled the group and charged several of its members, acting on the basis of information provided by the US.Joe Tidy, ‘REvil ransomware gang arrested in Russia’, BBC (14 January 2022)
Analysed in 	Scenario 14: Ransomware campaign
Collected by: Anna Blechová
Category:Example
Category:2021