Full Report
The Huntress team recaps what happened during the Kaseya VSA supply chain attack—and what we can learn from it.
Analysis Summary
# Incident Report: Kaseya VSA Supply Chain Attack (REvil)
## Executive Summary
In July 2021, the REvil ransomware group executed a sophisticated supply chain attack targeting Kaseya’s VSA remote monitoring and management (RMM) software. By exploiting zero-day vulnerabilities in on-premises VSA servers, attackers deployed ransomware to approximately 50-60 Managed Service Providers (MSPs), subsequently encrypting the systems of 1,500 to 2,000 downstream small-to-medium businesses (SMBs). The attack is considered one of the most significant MSP-focused incidents due to its scale and the bypass of security measures like MFA.
## Incident Details
- **Discovery Date:** July 2, 2021
- **Incident Date:** July 2, 2021 (coordinated with the U.S. July 4th holiday weekend)
- **Affected Organization:** Kaseya (and its MSP partners/customers)
- **Sector:** Information Technology / Managed Service Providers
- **Geography:** Global (significant impact in the United States)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2, 2021 (Midday EDT)
- **Vector:** Exploitation of zero-day vulnerabilities in on-premises Kaseya VSA servers.
- **Details:** Attackers utilized an authentication bypass vulnerability to gain access without valid credentials, circumventing Multi-Factor Authentication (MFA).
### Lateral Movement
- **Mechanism:** The attackers leveraged the inherent "trusted" nature of the RMM tool. Once the VSA server was compromised, the attackers used the software's own administrative powers to push malicious payloads to all connected agent endpoints managed by the MSP.
### Data Exfiltration/Impact
- **Details:** The primary impact was mass encryption of data via REvil ransomware. The attackers bypassed local security by using the VSA's "mothership" capability to execute commands on thousands of downstream endpoints simultaneously.
### Detection & Response
- **Discovery:** Detection occurred within 30 minutes of the first reports as multiple MSPs contacted Huntress reporting simultaneous ransomware infections across their entire customer bases.
- **Response:** Kaseya issued an immediate advisory for all customers to shut down on-premises VSA servers to prevent further spread. Security researchers began analyzing the uploaded files (`agent.crt` and `Screenshot.jpg`) to understand the execution chain.
## Attack Methodology
- **Initial Access:** Authentication bypass on the public-facing Kaseya VSA web interface.
- **Persistence:** Not extensively required; the attack focused on immediate mass-deployment of ransomware.
- **Privilege Escalation:** Exploited the VSA's system-level access to managed endpoints.
- **Defense Evasion:** Used `Screenshot.jpg` to delete IIS logs to hide web activity; utilized the "trusted" RMM agent to execute the payload, which often bypasses traditional antivirus.
- **Discovery:** Automated scanning for internet-facing VSA servers.
- **Lateral Movement:** Automated deployment from the VSA server to all managed agents (Vertical movement in a supply chain).
- **Impact:** Mass data encryption via REvil ransomware.
## Impact Assessment
- **Financial:** Massive; REvil initially demanded a $70 million universal decryptor ransom.
- **Data Breach:** While primarily an availability attack (encryption), the scale of data rendered inaccessible was immense.
- **Operational:** Total business disruption for up to 2,000 SMBs; many were unable to operate for days/weeks.
- **Reputational:** Significant damage to the "trusted provider" model of MSPs.
## Indicators of Compromise
- **File indicators:**
- `agent.crt` (Core payload)
- `Screenshot.jpg` (Script used for log deletion and database manipulation)
- **Behavioral indicators:**
- Unexpected administrative account creation on VSA servers.
- Automated deletion of IIS (Internet Information Services) logs.
- Sudden, mass execution of high-privilege tasks across all managed endpoints.
## Response Actions
- **Containment:** Urgent recommendation to take all on-premises VSA servers offline immediately.
- **Eradication:** Removal of malicious files and scripts from VSA servers; patching of the zero-day vulnerabilities.
- **Recovery:** Development and eventual release of a decryption key to help victims recover data without paying the ransom.
## Lessons Learned
- **The "Single Point of Failure" Risk:** Tools designed for efficiency (RMMs) are also highly efficient for attackers.
- **MFA is Not a Silver Bullet:** If an application has an authentication bypass vulnerability, MFA can be completely circumvented.
- **Supply Chain Vulnerability:** Attackers are moving upstream to target service providers to achieve a "multiplier effect" on their impact.
## Recommendations
- **Restrict Access:** Ensure RMM management interfaces are not directly exposed to the open internet; use VPNs or IP whitelisting.
- **Hardening:** Implement strict principle of least privilege for RMM service accounts.
- **Monitoring:** Monitor for unusual activity in RMM logs, such as unexpected script deployments or the deletion of web server logs.
- **Incident Readiness:** MSPs must have an incident response plan that accounts for their own infrastructure being the source of an infection.