The most recent in a long list of IT security firms that have been hit with ransomware in the past year, Miami-based Kaseya Ltd disclosed late last week that it was hit with a ransomware attack that may affect hundreds, even thousands, of U.S.-based companies.
Kaseya has publicly stated that it is investigating the attack on its product VSA, which is a widely-used tool that remotely monitors and manages networks and servers, network devices, and printers. According to Kaseya, “a small number of on-premises customers” (which it estimates to be fewer than 60) may have been affected. Kaseya has urged its customers to turn off their servers that were using VSA. Unfortunately, many of the 60 Kaseya customers are IT providers to other companies, so Kaseya believes that the “total impact thus far has been to fewer than 1,500 downstream businesses.”
It is widely believed that REvil, a notorious ransomware group based in Russia was behind the attack. The supply-chain attack is expected to affect managed services providers that use VSA for small business customers.
Kaseya has stated that it will be sending out a patch in the next few days. In the meantime, any company that believes it may be affected by the attack is urged to contact FBI’s Internet Crime Complaint Center and “to immediately follow the guidance from Kaseya including shutting down your VSA servers and implementing CISA’s and FBI’s mitigation techniques.”