IT company Kaseya has been hit by a major ransomware attack and is working to resolve its aftermath. It is working with FireEye Mandiant to resolve the incident and to assess the manner and impact of the attack and identify and mitigate the vulnerability.<\/p>\n\n\n\n
A statement from the company said: \u201cKaseya\u2019s VSA\u202fproduct\u202fhas unfortunately\u202fbeen\u202fthe victim of a sophisticated cyberattack.\u202f\u202fDue to our\u202fteams\u2019\u202ffast response, we believe that this has been localized to a very small number of on-premises\u202fcustomers\u202fonly.<\/p>\n\n\n\n
\u201cOur security, support, R&D, communications and customer teams continue to work around the clock in all geographies to resolve the issue and restore our customers to service.\u201d<\/p>\n\n\n\n
Charl van der Walt, Head of Security Research, Orange Cyberdefense, said: \u201cThese so-called \u2018supply chain attacks\u2019 are the consequence of several diverse factors that have colluded to make a compromise of this kind almost inevitable. One of these factors is \u2018IT Interdependence\u2019 – IT systems and the businesses that use them do not operate in isolation. As a result, the impact of a breach or compromise is never restricted to the primary target alone.<\/p>\n\n\n\n
\u201cWe simply cannot afford to think of our own security as isolated or separate from the security of our technology product or service providers, or from the myriad of other business entities or government agencies we share technology with. A shared dependency on core technologies, vendors, protocols or core Internet systems like DNS or CDNs bind businesses together just as tightly as fibre links and IP networks. Businesses in turn also bind together the suppliers who depend on them, the industries they belong to, the countries they operate in and, eventually, the entire global economy.<\/p>\n\n\n\n
\u201cBy their very nature, supply chain attacks provide the attacker with vast scope and scale, even if they take more resources and time to perpetrate. The frequency of these attacks is therefore not as important as their impact. Given the persistence of the systemic forces that enable these attacks, we anticipate that they will increase in both frequency and impact.<\/p>\n\n\n\n
\u201cWhen we consider when, where and how much to invest in security, we must think beyond the single-dimensional risk we are addressing for our business and consider the impact of the secondary and tertiary effects on the broader economy when breaches and compromises happen. We need to recognise that what\u2019s bad for society generally, is also bad for us as businesses.\u201d<\/p>\n\n\n\n
James Shank, Ransomware Task Force Committee Lead for Worst Case Scenarios and Chief Architect, Community Services for Team Cymru, said: \u201cVendors and supply chains enable business growth and efficiency, but they also create high value targets for attackers. With SolarWinds, CodeCov, and now Kaseya being some of the recent software and IT system supply chain attacks that enabled attackers to hit their customers, the writing on the wall is crystal clear: Attackers are looking for ways to compromise supply chain vendors to amplify their reach into victims.<\/p>\n\n\n\n
\u201cThis is not the first and it won\u2019t be the last. It is time to add another item to the already overwhelmed corporate security teams: audit suppliers and integrations with your supply chain providers. Limit exposure to the absolute minimum while still enabling business operations.<\/p>\n\n\n\n
\u201cDuring the Ransomware Task Force Worst Case Scenarios thought experiment, this exact scenario was identified as a critical weakness. It isn\u2019t clear how best to respond, as the world – and enterprise operations – becomes more and more connected and co-dependent every day. Each of these connections can be a pathway for massively good things, but also opens the door to a shared fate scenario, where a security incident at your supplier is likely to also become an incident on your network.<\/p>\n\n\n\n
\u201cThe new security operations paradigm must consider suppliers as part of their extended perimeter to defend. Being able to see exposures and threats beyond the traditional network perimeter needs to become part of best in class security practice.\u201d<\/p>\n\n\n\n
Chris Grove, Product Evangelist, Nozomi Networks, said: \u201cThis type of a supply chain attack, similar to the SolarWinds attack, goes straight to the jugular of organisations looking to recover from a breach.<\/p>\n\n\n\n
\u201cThese types of technology management solutions can have high concentrations of risk due to their large collection of enterprise accounts with elevated privileges, unrestricted firewall rules needed for them to operate, and a cultural \u2018trust\u2019 that the traffic to\/from them is legitimate and should be allowed.<\/p>\n\n\n\n
\u201cOnce a breach happens, the victim would generally reach for these tools to work their way out of a bad situation, but when the tool itself is the problem, or is unavailable, it adds complexity to the recovery efforts.<\/p>\n\n\n\n
\u201cAt times like this, when we don\u2019t fully understand the scope and tactic used, or which versions are affected, visibility into the blast radius of the attacker is crucial. Knowing which systems were impacted, which were used for lateral movement, or where the attackers may be hiding, ensures defenders can make educated decisions on the ground. When it comes to defending critical infrastructure, that visibility could make all the difference between the power being on or off.\u201d<\/p>\n\n\n\n
Ross McKerchar, Sophos Vice President and Chief Information Security Officer, said: “This is one of the farthest reaching criminal ransomware attacks that Sophos has ever seen. At this time, our evidence shows that more than 70 managed service providers were impacted, resulting in more than 350 further impacted organizations.<\/p>\n\n\n\n
\u201cWe expect the full scope of victim organizations to be higher than what\u2019s being reported by any individual security company. Victims span a range of worldwide locations with most in the United States, Germany and Canada, and others in Australia, the U.K. and other regions.”<\/p>\n\n\n\n
Mark Loman, Sophos Director of Engineering, said: \u201cSophos is actively investigating the attack on Kaseya, which we see as a supply chain distribution attack. The adversaries are using MSPs as their distribution method to hit as many businesses as possible, regardless of size or industry type.<\/p>\n\n\n\n
\u201cThis is a pattern we\u2019re starting to see as attackers are constantly changing their methods for maximum impact, whether for financial reward, stealing data credentials and other proprietary information that they could later leverage, and more. In other widescale attacks we\u2019ve seen in the industry, such as WannaCry, the ransomware itself was the distributor \u2013 in this case, MSPs using a widely used IT management are the conduit. <\/p>\n\n\n\n
\u201cSome successful ransomware attackers have raked in millions of dollars in ransom money, potentially allowing them to purchase highly valuable zero-day exploits. Certain exploits are usually only deemed attainable by nation-states. Where \u2018nation-states\u2019 would sparingly use them for a specific isolated attack, in the hands of cybercriminals, an exploit for a vulnerability in global platform can disrupt many businesses at once and have impact on our daily lives. <\/p>\n\n\n\n
\u201cA day after the attack, it became more evident that an affiliate of the REvil Ransomware-as-a-Service (RaaS) leveraged a zero-day exploit that allowed it to distribute the ransomware via Kaseya\u2019s Virtual Systems Administrator (VSA) software. Usually, this software offers a highly trusted communication channel that allows MSPs unlimited privileged access to help many businesses with their IT environments.\u201d<\/p>\n\n\n\n
Based on Sophos threat intelligence, REvil has been active in recent weeks, including in the JBS attack, and is currently the dominant ransomware gang involved in Sophos\u2019 defensive managed threat response cases.<\/p>\n\n\n\n