New details about the recent ransomware campaign against Kaseya’s customers reveal the change in tactics could cost the threat actors dear.
Ransomware attacks are usually targeted campaigns directed towards specific targets. However in order to maximize the damage, REvil instead exploited the zero-day in Kaseya's VSA software to compromise several managed service providers (MSP) and deliver ransomware to their downstream customers.
While they might have been successful in conducting the largest known ransomware attack, the change in modus operandi meant that the attackers could neither exfiltrate any data nor encrypt the backups of their victims, leading many to restore their machines.
- These are the best ransomware protection tools
- Here's our choice of the best malware removal software on the market
- Protect your devices with these best antivirus software
"In the Kaseya attack, they opted to try and impact EVERY Kaseya client by targeting the software vs direct ingress to an MSP's network. By going for such a broad impact they appear to have sacrificed the step of encrypting / wiping backups at the MSP control level," Bill Siegel, CEO of ransomware negotiation firm Coveware, told BleepingComputer.
Killing the golden goose
In their bid to infect downstream Kaseya users around the world, REvil had to rely on automated mechanisms for removing backups, some of which were reportedly coded very sloppily.
Also, since the infected victims were clients of Kaseya managed service providers (MSP), which is how they were targeted in the first place, most if not all would probably have offsite backups with their MSPs.
Siegel told BleepingComputer that although the attack did cause disruption, the overall damage wouldn’t be proportional since the amount of unrecoverable encrypted data will “end up being minimal.”
Although some victims have reportedly caved in to REvil’s demands and coughed up the ransom, Siegel believes the limited amounts of unrecoverable data “will translate to minimal need to pay ransoms.”
- These are the best data loss prevention services
