SC-KASEYA-VSA-2021

How it happened

Kaseya VSA is the kind of software that runs the internet's plumbing without most people knowing it exists. It is a remote-monitoring-and-management (RMM) tool that managed service providers use to administer their customers' computers in bulk: pushing patches, installing software, running scripts, all with deep privilege on thousands of machines at once. That reach is exactly what made it a perfect weapon.

The REvil ransomware crew had a chain of zero-days in the internet-facing VSA server, beginning with an unauthenticated credential leak (CVE-2021-30116) that handed them a valid session and led on to code execution. They timed their strike for the Friday afternoon of a long holiday weekend, when IT teams were thinnest. Using the flaws, they pushed what looked like a routine Kaseya update through the trusted deployment channel; the VSA agents on every downstream endpoint accepted it because it came from their own management server. The update ran a script that first disabled Windows Defender, then used a legitimate, Microsoft-signed Defender binary to side-load REvil's encryptor, so the malware executed under a trusted process. One compromise of one product cascaded, through the MSPs that used it, to all of their customers at once, and from first exploit to mass encryption took under two hours. In a bitter detail, the Dutch disclosure institute DIVD, whose researcher Wietse Boonstra had found the bugs, had privately reported them to Kaseya months earlier, and Kaseya was finishing the patch when REvil struck first.

The damage

Roughly 1,500 businesses were ransomwared in a single stroke, almost none of which had ever heard of Kaseya: dentists, accountants, schools, and small firms whose IT was outsourced. The most visible victim was Sweden's Coop supermarket chain, which had to close about 800 stores because its checkout systems were frozen, though Coop was never a Kaseya customer itself; it was hit two hops down, through a managed-service provider (Visma Esscom) that ran VSA. REvil demanded a flat $70 million for a universal decryptor, or individual ransoms from $45,000 to $5 million. The saga ended unusually: the FBI quietly obtained REvil's universal decryption key by penetrating its infrastructure, then held it for about three weeks while planning a takedown, before finally sharing it so victims could recover for free. REvil's servers went dark soon after, the group was disrupted by a multi-country operation in October 2021, and in January 2022 Russia's FSB arrested members at the United States' request.

Why Kaseya still matters

Kaseya is the cleanest illustration of supply-chain blast radius through trust. The tools with the most reach, RMM, software deployment, MSP platforms, are precisely the ones an attacker wants, because compromising one of them compromises everyone downstream simultaneously. It also showed that timing is a weapon: attackers strike on holidays and weekends on purpose, and a fully automated cascade can outrun any human response (here, under two hours). The defences are to treat RMM and deployment tooling as crown-jewel infrastructure (minimal internet exposure, MFA, strict segmentation), patch internet-facing management servers on the shortest possible SLA, constrain and alert on what those tools can deploy, apply application allowlisting so an unexpected pushed binary cannot run, and keep offline backups, because a cascading attack hits many victims at once. It belongs in the same story as SolarWinds: trusted management software turned into a delivery mechanism.