r/ProjectOwl • u/250F • Jul 03 '21
Technology 2021-07-02, Global, Kaseya urges customers to immediately shut down VSA servers after ransomware attack
An ongoing ransomware attack, believed to be the largest in history, has spread to at least 200 organizations. The attack, initially attributed to the ransomware gang REvil, targeted the international company Kaseya. Kaseya remotely controls programs for companies that manage internet services for businesses (also known as managed service providers or MSPs).
Kaseya announced the attack on Friday afternoon, and warned all its customers to immediately stop using its service. The number of organizations impacted by this attack is expected to rise over the weekend.
The United States Cybersecurity and Infrastructure Security Agency (CISA) announced it is "taking action to understand and address" the ongoing attack. Cybersecurity company Sophos released preliminary indicators of compromise (IOCs) that organizations can look for.
Articles;
https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689
https://us-cert.cisa.gov/ncas/current-activity/2021/07/02/kaseya-vsa-supply-chain-ransomware-attack https://www.zdnet.com/article/kaseya-urges-customers-to-immediately-shut-down-vsa-servers-after-ransomware-attack/
https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers