Criminals target Kaseya victims with fake Microsoft update

ransomware avast
(Image credit: Avast)

Cybersecurity researchers have found evidence of an opportunistic email campaign to trick the victims of the Kaseya-REvil ransomware attack to take control over the functional machines in their network.

The notorious REvil gang conducted a massive supply chain ransomware attack late last week, which according to conservative estimates has affected thousands of businesses around the world.

The Malwarebytes Threat Intelligence Team has now shared details of a malspam campaign that falsely promises to deliver a Microsoft security update to help fix the vulnerability in Kaseya software that was exploited by REvil to deploy ransomware.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.

>> Click here to start the survey in a new window <<

Although REvil claims to have infected over a million machines, Kaseya CEO Fred Voccola  has said it was difficult to pin down the exact number of targets, since the victims were customers of its customers.

New malspam campaign

In a live blog, tracking the developments related to this particular ransomware campaign, Malwarebytes researchers have shared details of an email that is playing on the insecurities of victims, by offering them an update to help patch the Kaseya vulnerability.

“Guys please install the update from Microsoft to protect against ransomware as soon as possible. This is fixing a vulnerability in Kaseya,” reads the spurious email.

However, in the guise of the update, the attachment in the emails instead delivers the penetration testing software Cobalt Strike, which the attackers use to break into the victims’ network and machines.

Malwarebytes hasn’t speculated about the identity of the group behind this new malspam campaign.

TOPICS
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
Shutterstock.com / kanlaya wanon
Microsoft Teams abused in Russian email bombing ransomware campaign
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
These fake macOS updates are actually just looking to spread malware
Image depicting hands typing on a keyboard, with phishing hooks holding files, passwords and credit cards.
Microsoft warns about a new phishing campaign impersonating Booking.com
A pair of hands using a keyboard
Microsoft SharePoint hijacked to spread Havoc malware
ransomware avast
Hackers spotted using unsecured webcam to launch cyberattack
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Latest in News
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone&#039;s hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI