A vulnerability in software vendor Kaseya’s virtual system/server administrator (VSA) software has been exploited to deliver the “REvil” (aka Sodinokibi) ransomware to multiple managed service providers (MSPs) and their customers. This supply-chain attack reportedly exploited an authentication bypass vulnerability and delivered REvil via a fake security update. REvil reacted negatively to an Executive Order of US President Joe Biden, and it is realistically possible that this attack was retaliatory. Given that the attack occurred over the US Independence Day holiday weekend, and given the trust customers have placed in Kaseya’s VSA, REvil more likely focused its targeting on Kaseya rather than conducting an opportunistic attack. Any action taken by the US government in light of this attack is unlikely to slow down REvil’s operations, and more attacks are likely in the short-term future (within three months).
Want To Try Our Digital Risk Protection Tool?Get Started Free
Other content in this Stream
Main story: Ransom Cartel and REvil: Partners in cybercrime?
Main story: Hacktivists fan flames of Iranian anti-regime protests
Main story: ProxyNotShell spells déjà vu for MS Exchange Server defenders
Main story: Rogue ex-developer leaks LockBit 3.0 builder
Main story: Uber compromised by Lapsus$'s resurgence
Main story: Cyber attacks shock the Italian energy sector
Main story: Back to school for students and ransomware groups
Main story: LastPass suffers source code data breach
Main story: LockBit under DDoS attack: Entrust strikes back?
Main Story: Cisco defies extortion attempts after network breach
Main story: Cybercriminals scramble for new hiding places after 911 proxy service folds
Main story: Free-to-use Redeemer opens doors for ransomware enthusiasts