REvil bungled its massive ransomware attack, giving businesses an easy out scammers
New details about the recent ransomware campaign against Kaseya’s customers reveal the change in tactics could cost the threat actors dear.
Ransomware attacks are usually targeted campaigns directed towards specific targets. However in order to maximize the damage, REvil instead exploited the zero-day in Kaseya’s VSA software to compromise several managed service providers (MSP) and deliverransomware to their downstream customers.
While they might have been successful in conducting the largest known ransomware attack, the change in modus operandi meant that the attackers could neither exfiltrate any data nor encrypt the backups of their victims, leading many to restore their machines.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
“In the Kaseya attack, they opted to try and impact EVERY Kaseya client by targeting the software vs direct ingress to an MSP’s network. By going for such a broad impact they appear to have sacrificed the step of encrypting / wiping backups at the MSP control level,” Bill Siegel, CEO of ransomware negotiation firm Coveware, told BleepingComputer.
Killing the golden goose
In their bid to infect downstream Kaseya users around the world, REvil had to rely on automated mechanisms for removing backups, some of which were reportedly coded very sloppily.
Also, since the infected victims were clients of Kaseya managed service providers (MSP), which is how they were targeted in the first place, most if not all would probably have offsite backups with their MSPs.
Siegel told BleepingComputer that although the attack did cause disruption, the overall damage wouldn’t be proportional since the amount of unrecoverable encrypted data will “end up being minimal.”
Although some victims have reportedly caved in to REvil’s demands and coughed up the ransom, Siegel believes the limited amounts of unrecoverable data “will translate to minimal need to pay ransoms.”
New details about the recent ransomware campaign against Kaseya’s customers reveal the change in tactics could cost the threat actors dear. Ransomware attacks are usually targeted campaigns directed towards specific targets. However in order to maximize the damage, REvil instead exploited the zero-day in Kaseya’s VSA software to compromise several…
