Kaseya apologises for extended downtime after ransom attack

He said Kaseya’s teams had locked down the vulnerabilities exploited in the attack and felt comfortable with the release, but, on the advice of third-party cyber consultants and Kaseya’s own engineers, they wanted to take time to put additional protections in place and harden VSA as much as possible.

Kaseya was downed late in the day on Friday 2 July by the REvil gang, ahead of a holiday weekend for the US company.

Between 50 and 60 of its managed service provider (MSP) customers were hit, with the cumulative impact spreading to thousands of downstream businesses – many of them small ones – that rely on the IT channel for their tech resource.

Most notably, the Swedish Coop supermarket chain was forced to shut hundreds of stores due to its payment systems dropping offline.

The ransomware operators have demanded $70m for a master decryption key, and far smaller sums from individual victims (see image below), but Voccola has been vocal in his refusal to negotiate with the criminals. It is not known if any of the other impacted businesses have entered negotiations.

In the past 24 hours, more details have begun to emerge via the Dutch Institute for Vulnerability Disclosure (DIVD) of the precise vulnerabilities exploited by REvil.

DIVD said it had been working extensively behind the scenes on seven newly discovered common vulnerabilities and exposures (CVEs) in the VSA product since 6 April.

These are CVE-2021-30116, a credential leak and business logic flaw; CVE-2021-30117, a SQL injection vulnerability; CVE-2021-30118, a remote code execution (RCE) vulnerability; CVE-2021-30119, a cross-site scripting (XSS) vulnerability; CVE-2021-30120, a two-factor authentication (2FA) bypass; CVE-2021-30121, a local file inclusion vulnerability; and CVE-2021-30201, an XML external entity vulnerability.

Of these, 30117, 30118, 30121 and 30201 have been resolved in previous patches, from which one can now infer that REvil used one or more of 30116, 30119 and 30120 to access the target systems.

DIVD’s chairman, Victor Gevers, said that, throughout the process, Kaseya had shown that it was willing to put maximum effort and initiative into getting the issue fixed and its customers patched.

“[Kaseya] showed a genuine commitment to do the right thing,” he said. “Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch.”