The Kaseya VSA Attack: Ransomware Through the Management Tool

If you wanted to encrypt as many companies as possible with the least effort, you would not attack them individually. You would find the software that already has permission to run code on all of their machines.

That software exists, it is called remote monitoring and management, and thousands of small businesses have it installed because their IT provider needs a way to administer their laptops. On 2 July 2021, the REvil operation exploited zero-day flaws in one such platform and used its own deployment mechanism to distribute ransomware to the endpoints it managed.

Roughly 1,500 businesses were encrypted. Almost none of them had heard of the vendor.

Timeline

Date	Event
April 2021	The Dutch Institute for Vulnerability Disclosure reports vulnerabilities in Kaseya VSA. Fixes are in progress
2 July 2021, before the US Independence Day weekend	Attackers exploit the flaws against internet-facing VSA servers and push ransomware through the platform
2 to 4 July 2021	CISA and the FBI publish guidance. Kaseya advises customers to shut down VSA servers immediately
3 July 2021	Coop, a Swedish supermarket chain, closes hundreds of stores after its point of sale systems are affected through a provider
5 July 2021	REvil demands 70 million dollars for a universal decryptor
11 July 2021	Kaseya releases patches for on-premises VSA
22 July 2021	Kaseya obtains a decryption key and begins helping victims

Why an RMM platform is the ideal target

The properties that make these tools useful are precisely the properties an attacker wants.

It runs code as SYSTEM on every managed endpoint. That is the product. Deploying software, running scripts and applying configuration are its core functions, and they execute with the highest privileges available.

It reaches everything at once. One console administers thousands of machines across dozens of client organisations. There is no lateral movement to perform; the fan-out is a feature.

It is usually excluded from endpoint protection. Because the agent legitimately does things that look malicious (running scripts, installing software, executing remote commands), administrators add exclusions to stop the security product interfering. Anything the agent deploys inherits that exclusion, so the ransomware arrived through a channel that endpoint protection had been told to ignore.

It is often internet-facing. The console has to be reachable for technicians working remotely and for agents checking in from client sites.

It is administered by a small team under time pressure. Managed service providers are usually thin on staff, and the console is frequently protected by a password without strong authentication.

Put together, this is a distribution channel with privileged execution, wide reach, security exclusions and internet exposure. It is worth naming that explicitly, because the same description fits every RMM product rather than one vendor's.

The MSP amplifier

The victims were mostly small businesses: dental practices, accountancy firms, schools, regional retailers, local government. They had outsourced IT to a provider, which is sensible, and the provider used a management platform, which is necessary.

The consequence is a supply chain that most of the victims could not see. A business that had never made a decision about Kaseya, had no contract with them, and could not have patched anything, was encrypted because their IT provider's console was compromised.

Coop is the clearest illustration. A supermarket chain closed hundreds of stores because its point of sale systems were managed by an affected provider. The chain's own security posture was not the determining factor.

This is the same fourth-party structure as The MOVEit Breach, reached through management tooling rather than file transfer, and it is why supplier questions belong in the contract rather than in the post-incident review.

The disclosure race

The most instructive detail is that the vulnerabilities were already reported.

Researchers had disclosed them to Kaseya through a coordinated process. The vendor was working on fixes. The attack landed inside that window.

Coordinated disclosure exists because publishing a vulnerability with no patch available leaves everyone exposed, and it is the right default. It also creates a period in which the flaw is known to some people and unfixed for everyone, and during which anyone else who independently finds it can exploit it against a defenceless population. Coordinated Vulnerability Disclosure Explained covers the trade-offs; this incident is the strongest available example of the cost side.

Nothing in that observation is a criticism of the researchers, who did exactly the right thing. It is an argument for vendors treating a reported pre-authentication flaw in an internet-facing management product as an emergency rather than as a scheduled fix.

Holiday timing

The attack began before the US Independence Day weekend. Cl0p's MOVEit campaign began before Memorial Day weekend two years later. This is a deliberate and repeated choice: skeleton staffing, delayed detection, slower vendor response, and more time to spread before anyone notices.

The practical consequence for defenders is unglamorous. Long weekends and holiday periods need on-call coverage with real authority to act, an escalation path that works when the usual people are away, and a pre-authorised decision to isolate systems without waiting for a manager who is on a beach.

The decryptor

REvil demanded 70 million dollars for a universal decryptor. In late July, Kaseya obtained a decryption key and made it available to affected customers.

The FBI subsequently confirmed it had obtained the key and had withheld it for a period while planning a disruption operation against the group's infrastructure. That drew criticism, because victims were down and waiting during that time, and it is a genuine tension: disrupting an operation permanently protects future victims, while sharing the key immediately helps the current ones.

For planning purposes the lesson is simpler. A key arriving through law enforcement is an unusual outcome and cannot be part of a recovery plan. The plan is backups you can restore, per 3-2-1 Backup Strategy.

What to do about it

If you are a managed service provider:

• Treat the RMM console as tier zero infrastructure, with phishing-resistant authentication for every administrator and no standing access, per Privileged Access Management Explained.
• Do not expose the console to the internet unrestricted. Put it behind a VPN or restrict by network.
• Patch it on an emergency clock, and subscribe to the vendor's security advisories directly.
• Segment client environments so one compromised console cannot deploy to every client simultaneously.
• Alert on unusual deployments: a script pushed to every endpoint at once outside a change window is the exact signature of this attack.

If you use a managed service provider:

• Ask which management platform they use, whether it is internet-exposed, and how administrative access is protected.
• Ask how quickly they patch it, and what happened the last time their vendor issued a critical advisory.
• Ask what isolates your environment from their other clients.
• Keep backups that your provider's console cannot reach or delete, which is the specific control that saved organisations in this incident.
• Put notification obligations in the contract.

What generalises

1. Anything with privileged execution across many endpoints is a distribution channel. RMM, patch management, configuration management, software deployment, and the EDR agent itself.
2. Security exclusions are inherited by whatever the excluded process deploys.
3. Your provider's security is your security, and it is a contract question rather than a technical one.
4. Coordinated disclosure has an exposure window. Vendors should treat reported pre-auth flaws in exposed management products as emergencies.
5. Holidays are attack windows. Staff them.
6. Backups the management tooling cannot reach are what makes this survivable.

The verdict

The attackers did not need to compromise 1,500 companies. They compromised the software those companies' IT providers used to manage them, and let it do the distribution.

The uncomfortable part is that the affected businesses did nothing wrong by any ordinary standard. They outsourced IT, which is what a small business should do. The controls that would have helped them sit in their provider's console and in a backup their provider's console could not delete.

Related guides

• The MOVEit Breach
• Ransomware as a Service Explained
• Privileged Access Management Explained
• 3-2-1 Backup Strategy
• Coordinated Vulnerability Disclosure Explained