Suspected Russia-linked hacking group REvil (Ransomware Evil/Sodinokibi) has demanded $70 million in bitcoin after attacking Kaseya Limited, an American software company that develops software for managing networks, systems, and information technology infrastructure.
It was reported a few days ago that a hacking tsunami hit hundreds of companies when a supply chain attack exploited Kaseya's IT management software which is used by Managed Service Providers to perform IT tasks remotely. REvil deployed a malicious software update that exposes providers who use the platform, and their clients.
Although, the situation is still developing and certain details on how the attackers infiltrated the software is still unknown. But the impact has already been severe and will only get worse given the nature of the targets.
A threat researcher, Kevin Beaumont, in his own opinion stated that instead of getting Kaseya’s latest update, they received REvil’s ransomware. Kaseya was initially breached through a previously unknown vulnerability in its systems — known as a “zero-day” because when such vulnerabilities are discovered, software makers have zero days to fix it. In the meantime, cybercriminals and spies can use the vulnerability to wreak havoc.
The notorious cybercriminal gang that has used ransomware to go after big-name companies, including Apple and Acer and recently, targeted JBS, the world’s largest meat processing company, which paid it $11 million in bitcoin to mitigate the fallout from the attack and protect its data are asking for a $70 million ransom in bitcoin to publish a public universal decryptor that will unlock all affected computers.
According to REvil “On Friday (02.07.2021) we launched an attack on MSP providers. More than a million systems were infected,” the REvil gang said, according to the Record. “If anyone wants to negotiate about universal decryptor–our price is 70 000 000$ in BTC and we will publish publicly decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour. If you are interested in such a deal–contact us using victims ‘readme’ file instructions.”
In response to the incident and development that follow, Kaseya has stated that Kaseya’s SaaS cloud servers should remain offline until customers receive instructions from Kaseya about when it’s safe to restore operations. On Sunday, Kaseya CEO Fred Voccola said the company knew how the attack had happened and that it was remediating it.