Full Report
In this blog, we share details on the vaccine Huntress deployed to our partners to protect them from being infected by the Kaseya VSA ransomware attack.
Analysis Summary
# Incident Report: REvil Ransomware Attack via Kaseya VSA Exploitation
## Executive Summary
On July 2, 2021, the REvil (Sodinokibi) ransomware group executed a sophisticated supply-chain attack leveraging a zero-day vulnerability in Kaseya VSA remote management software. The attackers distributed a malicious "hot-fix" to downstream Managed Service Providers (MSPs) and their clients, leading to widespread encryption. Huntress responded by deploying a "vaccine" that utilized the same mechanism as the attackers to preemptively block the ransomware's execution on partner endpoints.
## Incident Details
- **Discovery Date:** July 2, 2021
- **Incident Date:** July 2, 2021
- **Affected Organization:** Kaseya (Primary), numerous MSPs and 1,500+ downstream businesses.
- **Sector:** Information Technology / Managed Service Providers
- **Geography:** Global (Primarily North America and Europe)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2, 2021 (Leading up to the July 4th holiday weekend)
- **Vector:** Exploitation of zero-day vulnerabilities in Kaseya VSA on-premises servers.
- **Details:** Attackers bypassed authentication to gain administrative access to VSA servers, allowing them to push malicious automation procedures to all connected agents.
### Lateral Movement
- **Movement:** The attack leveraged the trusted relationship between the VSA server and the endpoint agents. No traditional lateral movement was required as the VSA server already had high-level access to all managed endpoints.
### Data Exfiltration/Impact
- **Impact:** Massive ransomware deployment. The attackers used a command-line script to disable Windows Defender, decode a malicious payload (`agent.exe`) using a renamed version of `certutil.exe`, and execute Sodinokibi ransomware.
### Detection & Response
- **Discovery:** Rapid reports of mass encryption across multiple MSP environments.
- **Response Actions:** Huntress analyzed the attack chain and deployed a "vaccine" that created a "canary" or lock file in the `c:\kworking\` (or configured temp) directory, effectively preventing the malicious script from successfully executing its payload on protected systems.
## Attack Methodology
- **Initial Access:** Supply Chain Compromise (Exploitation of VSA Server).
- **Persistence:** Not required; the goal was immediate mass encryption.
- **Privilege Escalation:** Execution via the VSA Agent, which typically runs with SYSTEM privileges.
- **Defense Evasion:**
- Disabling Windows Defender via PowerShell (`Set-MpPreference`).
- Side-loading: Renaming `certutil.exe` to `cert.exe` and appending random data to change the file hash.
- Time Delay: Using `ping 127.0.0.1 -n 4979` as a sleep timer to bypass sandbox detection.
- **Credential Access:** Not applicable (trusted agent execution).
- **Discovery:** Automated script-based environmental checks.
- **Lateral Movement:** Push-based distribution from central management server.
- **Impact:** Data Encrypted for Impact (Sodinokibi/REvil).
## Impact Assessment
- **Financial:** Multi-million dollar ransom demands (up to $70M for a universal decryptor).
- **Data Breach:** While REvil typically exfiltrates data, the focus of this specific incident was high-volume availability disruption via encryption.
- **Operational:** Over 1,500 businesses experienced total work stoppage; several MSPs faced business-ending operational strain.
- **Reputational:** Significant damage to Kaseya’s brand and the perceived security of the MSP model.
## Indicators of Compromise
- **File Indicators:**
- `c:\kworking\agent.crt` (Encoded payload)
- `c:\kworking\agent.exe` (Decoded ransomware)
- `C:\Windows\cert.exe` (Renamed certutil.exe)
- **Behavioral Indicators:**
- `Set-MpPreference -DisableRealtimeMonitoring $true`
- High-frequency pinging to localhost for timing delays.
- Automated deletion of `cert.exe` and `agent.crt` post-execution.
## Response Actions
- **Containment:** Kaseya advised all customers to shut down VSA servers immediately.
- **Eradication:** Deployment of the Huntress "Vaccine" to block the specific file-creation path used by the REvil script.
- **Recovery:** Restoration from off-site backups; Kaseya eventually obtained a universal decryptor.
## Lessons Learned
- **Supply Chain Vulnerability:** Trusted administrative tools are the highest-value targets for threat actors.
- **Offensive Defense:** Proactive "vaccination"—using the attacker's own logic against them—can be an effective stop-gap during zero-day events.
- **Timing:** Attackers favor holiday weekends to maximize impact when staffing is low.
## Recommendations
- **Zero Trust for Management Tools:** Restrict VSA/RMM access to known IPs and enforce MFA.
- **Endpoint Hardening:** Implement EDR policies that alert on the renaming/moving of living-off-the-land binaries like `certutil.exe`.
- **Offline Backups:** Ensure backups are air-gapped from the primary management network to prevent simultaneous encryption.