# MA-810.072021: MyCERT Advisory - Kaseya VSA Supply-Chain Ransomware Attack

**Date:** 05 Jul 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-810.072021  
**Advisory ID:** MA-810.072021

---

**1.0 Introduction**
MyCERT is aware of recent supply-chain ransomware attack against Kaseya VSA and the multiple managed service providers (MSPs) that employ VSA software. MyCERT encourages organizations to review the Kaseya advisory and immediately follow their guidance to shutdown VSA servers.
**2.0 Impact**
Exploitation of the vulnerability may allow an attacker to take control of an affected Kaseya VSA software and deploy a variant of REvil ransomware into a victim’s environment. The attackers also seek to access and infiltrate the MSP’s customers computer networks.
**3.0 Affected Products**
- Organisations using Kaseya VSA software to manage their IT infrastructure.
- Any system managed by the VSA solution could be affected.
**4.0 Recommendations**
MyCERT strongly urge affected MSPs and their customers to follow the guidance below.
Recommendation for affected MSPs:
- Download the [Kaseya VSA Detection Tool](https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40). This tool analyzes a system (either VSA server or managed endpoint) and determines whether any indicators of compromise (IoC) are present.
- Enable and enforce multi-factor authentication (MFA) on every single account that is under the control of the organization, and—to the maximum extent possible—enable and enforce MFA for customer facing services.
- Implement allowlisting to limit communication with remote monitoring and management (RMM) capabilities to known IP address pairs, and/or
- Place administrative interfaces of RMM behind a virtual private network (VPN) or a firewall on a dedicated administrative network.
MyCERT also recommend MSP customers affected by this attack and do not currently have their RMM service running to take immediate action to implement the following cybersecurity best practices.
Recommendation for affected MSP customers:
- Ensure backups are up to date and stored in an easily retrievable location that is air-gapped from the organizational network;
- Revert to a manual patch management process that follows vendor remediation guidance, including the installation of new patches as soon as they become available;
- Implement:
Multi-factor authentication; and
Principle of least privilege on key network resources admin accounts.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://us-cert.cisa.gov/ncas/current-activity/2021/07/02/kaseya-vsa-supply-chain-ransomware-attack>
- <https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa>
- <https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689>
- <https://www.cert.govt.nz/it-specialists/advisories/kaseya-management-software-being-used-to-deploy-ransomware/>
- <https://www.bleepingcomputer.com/news/security/kaseya-was-fixing-zero-day-just-as-revil-ransomware-sprung-their-attack/>