BOSTON — The single most significant ransomware attack continued to bite Monday as more details emerged on how a Russia-linked gang breached the exploited software company. The criminals essentially used a tool that helps protect against malware to spread it globally. Thousands of organizations — nearly firms that remotely manage the IT infrastructure of others — were infected in at least 17 Fridays in Friday’s assault. Kaseya, whose product was exploited, said Monday that they include several just returning to work.
Because the attack by the notorious REvil gang came just as a long Fourth of July weekend began, many more victims were expected to learn their fate when they returned to the office Tuesday. REvil is best known for extorting $11 million from the meat processor JBS last month. Security researchers said its ability to evade anti-malware safeguards in this attack and its apparent exploitation of a previously unknown vulnerability on Kaseya servers reflect the growing financial muscle of REvil and a few dozen other top ransomware gangs whose success helps them afford the best digital burglary wares. Such criminals infiltrate networks and paralyze them by scrambling data and extorting their victims.
REvil sought $5 million payouts from the so-called managed service providers that were its principal downstream targets in this attack, apparently demanding much less — just $45,000 — from their afflicted customers. But late Sunday, it offered on its dark website a universal decryptor that would unscramble all affected mines if it’s paid $70 million in cryptocurrency. Some researchers considered the offer a PR stunt, while others thought it indicated the criminals have more victims than they can manage.
Sweden may be the most brutal hit — or at least most transparent about the damage. In a TV interview, its defense minister, Peter Hult’s”visit, bemoaned “how fragile the system is when it comes”to IT security.” Most of the SwedisCoop’sery chain Coop’s 800 stores were closed for the third day, their cash registers crippled. A Swedish pharmacy chain, ga a station chain, the state railway, and public broadcaster SVT also were hit. The cybersecurity firm Sophos said that a wide array of businesses and public agencies were affected, including financial services and travel, but few large companies were hit. Researchers noted the United Kingdom, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand, and Kenya were affected.
Most r ansomware victims loathe to admit it publicly, and many avoid reporting attacks to law enforcement or disclosing if they pay ransom unless required by law. In a statement Sunday, Deputy U.S. national security adviser Anne Neuberger urged all victims to alert the FBI. A day earlier, the FBIattacksn alert” that the attack’s scale “may make it so that we cannot respond to “ach victim individually.”iden said “Saturday t” at he ordered a “deep dive” by U.S. intelligence into the attack and that the U.S. would respond if it determines the Kremlin is involved. In Geneva last month, Biden sought to pressure Russian President Vladimir Putin to end a haven for REvil and other ransomware gangs that operate with impunity in Russia and allied states as long as they asyndicates’stargets. The syndicates’ extortionary attacks have worsened in the past year.
On Monday, Putin spokesman Dmitry Peskov was asked if Russia was aware of or had looked d into the attack. He said no but suggested it could be discussed during U.S.-Russian consultations on cybersecurity issues. No date has been set for such talks, and few analysts expect the Kremlin to crack down on a crime Putin’sat benefits Putin’s strategic objectives of destabilizing the West.
Kaseya said Monday that fewer than 70 of its 37,000 customers were affected, though most were managed service providers with multiple downstream customers. Most managed service providers were apt to know by Monday if they were hit, but that may not be true for many of the small and medium-sized organizations they serve, said Ross McKerchar, a chief information security officer at Sophos. The MSPs are flying blind because the attack knocked out the software tool they use to monitor customer networks.
The hacked Kaseya tool, VSA, remotely maintains customer networks, automating security and other software updates. In a Monday report on the attack, Sophos said a VSA server was breached with “he appeared”t use of a “zero-day,” the industry term for a previously unknown software security hole. Like other cybersecurity firms, it faulted Kaseya for aiding the attackers by asking customers not to m” monitor i”s on-premise “working” folders for malware. From REvil’sthose folders, REvil’s code could work undetected to disable the malware- and ransomwMicrosoft’sg tools of Microsoft’s Defender program.
Sophos said REvil did not attempt to steal data in this attack. Ransomware gangs usually do that before activating ransomware, so they can threaten to dump it online unless paid. This attack was bare-bones, only scrambling data. In a Sunday interview, Kaseya CEO Fred Voccola would not confirm the use of a zero-day or offer details of the breach — except to say that it was not phishing and that he was confident that when an investigation by the cybersecurity firm is complete, it will show that not just Kaseya but third-party software were breached by the attackers. Associated Press reporters Jim Heintz in Moscow and Jan Olsen in Stockholm contributed to this report.
