Full Report
Huntress is tracking a critical ransomware incident affecting MSPs and their customers, caused by a sophisticated Kaseya VSA supply chain attack.
Analysis Summary
# Incident Report: Kaseya VSA Supply Chain Ransomware Attack
## Executive Summary
In July 2021, a sophisticated supply chain attack targeted the Kaseya VSA remote monitoring and management (RMM) platform, leading to the deployment of REvil ransomware across numerous Managed Service Providers (MSPs). The attackers exploited zero-day vulnerabilities in the VSA software to push malicious payloads to downstream customer environments. The incident resulted in widespread operational disruption for thousands of small-to-medium businesses globally.
## Incident Details
- **Discovery Date:** July 2, 2021
- **Incident Date:** July 2, 2021
- **Affected Organization:** Kaseya (Primary), multiple MSPs and their clients (Downstream)
- **Sector:** Information Technology / Managed Service Providers
- **Geography:** Global (significant impact in US, Europe, and Australia)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2, 2021, approximately 2:00 PM ET
- **Vector:** Exploitation of zero-day vulnerabilities (including authentication bypass and arbitrary file upload) in on-premises Kaseya VSA servers.
- **Details:** Attackers gained access to the VSA web interface, allowing them to bypass authentication and execute administrative commands.
### Lateral Movement
- **Movement:** The attackers used the VSA’s built-in "working directory" and management capabilities to distribute a malicious update package to all managed agents (client endpoints) connected to the compromised VSA server. No traditional network lateral movement was required as the RMM tool provided direct access to all endpoints.
### Data Exfiltration/Impact
- **Impact:** Rather than traditional exfiltration, the primary impact was the mass encryption of files. The REvil ransomware was deployed via a fake "Kaseya VSA Agent Hotfix" to thousands of endpoints simultaneously.
### Detection & Response
- **Detection:** Rapidly identified by Huntress and the MSP community as a "mass ransomware" event after multiple partners reported concurrent encryption events across different client sites.
- **Response:** Kaseya issued an immediate "SaaS and On-Prem" shutdown order for all VSA servers to contain the spread.
## Attack Methodology
- **Initial Access:** Zero-day exploitation of Kaseya VSA web vulnerabilities.
- **Persistence:** High-level access to the VSA server allowed the scheduling of malicious tasks.
- **Privilege Escalation:** Exploited the trusted relationship between the VSA server and the VSA agent (which runs with SYSTEM privileges on endpoints).
- **Defense Evasion:** Used legitimate VSA processes (`agentmon.exe`) to drop payloads; utilized a side-loading technique involving a clean Microsoft Defender executable (`MsMpEng.exe`) to load a malicious DLL (`mpsvc.dll`).
- **Credential Access:** Not the primary focus; the attack leveraged the existing trusted architecture of the RMM tool.
- **Discovery:** Automated scanning for internet-facing VSA servers.
- **Lateral Movement:** Software distribution via VSA management procedures.
- **Collection:** N/A (Focus was on encryption).
- **Exfiltration:** N/A (Encryption focused).
- **Impact:** REvil Ransomware encryption of local disks and attached storage.
## Impact Assessment
- **Financial:** Multi-million dollar ransom demands (some up to $70M for a universal decryptor).
- **Data Breach:** Limited evidence of large-scale exfiltration prior to encryption in this specific VSA variant.
- **Operational:** Total business cessation for affected MSP clients; Kaseya SaaS infrastructure was offline for several days.
- **Reputational:** Significant loss of trust in RMM software security and supply chain integrity.
## Indicators of Compromise
- **Network Indicators:**
- Traffic to defanged IPs associated with initial exploit attempts (e.g., `18.223.199[.]234`, `161.35.239[.]241`).
- **File Indicators:**
- `agent.exe` (Malicious dropper)
- `mpsvc.dll` (Sideloaded REvil payload)
- `MsMpEng.exe` (Legitimate but used for side-loading)
- **Behavioral Indicators:**
- `certutil.exe` used to decode malicious payloads.
- Kaseya procedures executing PowerShell commands to disable Windows Defender real-time monitoring.
## Response Actions
- **Containment:** Kaseya shut down its SaaS platform and advised all on-premises customers to power off VSA servers immediately.
- **Eradication:** Deployment of a Detection Tool by Kaseya to identify compromised systems.
- **Recovery:** Restoration from off-site backups; eventual release of a universal decryptor after Kaseya obtained a key from a "third party."
## Lessons Learned
- **Supply Chain Fragility:** A single vulnerability in a management tool can lead to catastrophic downstream impact.
- **Privileged Tools as Weapons:** RMM tools are highly attractive to threat actors because they are designed to bypass security perimeters.
- **Response Speed:** The community-driven response (Huntress, Reddit, etc.) was faster than official vendor communications in the early hours.
## Recommendations
- **MFA:** Enforce Mandatory Multi-Factor Authentication for all RMM users.
- **Egress Filtering:** Limit the ability of RMM servers to communicate with the open internet except for known update sites.
- **Endpoint Protection:** Use EDR solutions that detect DLL side-loading and anomalous behavior from trusted processes like `agentmon.exe`.
- **Isolation:** Place management servers (like VSA) behind a VPN or IP-restricted firewall rather than exposing them directly to the internet.