New details about the recent ransomware (opens in new tab) campaign against Kaseya’s customers reveal the change in tactics could cost the threat actors dear.
Ransomware attacks are usually targeted campaigns directed towards specific targets. However in order to maximize the damage, REvil instead exploited the zero-day in Kaseya's VSA software to compromise several (opens in new tab) managed service providers (MSP) and deliver ransomware to their downstream customers.
While they might have been successful in conducting the largest known ransomware attack (opens in new tab), the change in modus operandi meant that the attackers could neither exfiltrate any data nor encrypt the backups of their victims, leading many to restore their machines.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
>> Click here to start the survey in a new window (opens in new tab) <<
- These are the best ransomware protection tools (opens in new tab)
- Here's our choice of the best malware removal (opens in new tab) software on the market
- Protect your devices with these best antivirus software (opens in new tab)
"In the Kaseya attack, they opted to try and impact EVERY Kaseya client by targeting the software vs direct ingress to an MSP's network. By going for such a broad impact they appear to have sacrificed the step of encrypting / wiping backups at the MSP control level," Bill Siegel, CEO of ransomware negotiation firm Coveware, told (opens in new tab) BleepingComputer.
Killing the golden goose
In their bid to infect downstream Kaseya users around the world, REvil had to rely on automated mechanisms for removing backups, some of which were reportedly coded very sloppily.
Also, since the infected victims were clients of Kaseya managed service providers (MSP), which is how they were targeted in the first place, most if not all would probably have offsite backups (opens in new tab) with their MSPs.
Siegel told BleepingComputer that although the attack did cause disruption, the overall damage wouldn’t be proportional since the amount of unrecoverable encrypted data will “end up being minimal.”
Although some victims have reportedly caved in to REvil’s demands and coughed up the ransom, Siegel believes the limited amounts of unrecoverable data “will translate to minimal need to pay ransoms.”
- These are the best data loss prevention services (opens in new tab)