Kaseya Gets Universal Decryptor to Help REvil Ransomware Victims

Nearly three weeks after Florida-based software vendor Kaseya
was hit by a widespread supply-chain ransomware
attack^[1], the company on Thursday
said it obtained a universal decryptor to unlock systems and help
customers recover their data.

“On July 21, Kaseya obtained a decryptor for victims of the
REvil ransomware attack, and we’re working to remediate customers
impacted by the incident,” the company said^[2]
in a statement. “Kaseya obtained the tool from a third-party and
have teams actively helping customers affected by the ransomware to
restore their environments, with no reports of any problem or
issues associated with the decryptor.”

It’s not immediately unclear if Kaseya paid any ransom. It’s
worth noting that REvil affiliates had demanded a ransom of $70 million^[3] — an amount that was
subsequently lowered to $50 million — but soon after, the
ransomware gang mysteriously went off the grid^[4], shutting down their
payment sites and data leak portals.

The incident is believed to have infiltrated as many as 1,500
networks that relied on 60 managed service providers (MSPs) for IT
maintenance and support using Kaseya’s VSA remote management
product as an ingress point for what has turned out to be one of
the “most important cybersecurity event of the
year^[5].”

Kaseya has since released patches for the
zero-days^[6] that were exploited to
gain access to Kaseya VSA on-premise servers, using the foothold to
pivot to other machines managed through the VSA software and deploy
a version of the REvil ransomware.

The fallout from the attack, waged through a breach in the
software supply chain, has raised new concerns about how threat
actors are increasingly abusing the trust associated with
third-party software to install malware, not to mention underscore
the swift damage caused by ransomware attacks on trusted
supply-chain providers, paralyzing hundreds of small and
medium-sized businesses and causing havoc at scale with just one
exploit.