Kaseya obtains ransomware decryptor to help VSA victims

Kaseya VSA customers struggling to recover from the REvil ransomware attack earlier this month have some good news: the company has received a decryptor to unscramble encrypted data.

The company said Thursday it is helping impacted customers after obtaining the decryption tool from an unnamed third party. So far it has had no reports of problems. Kaseya is working with Emsisoft to support customers’ efforts, and, it says, Emsisoft has confirmed the key is effective at unlocking victims’ data.

UPDATE: On July 26 Kaseya issued a statement “confirming in no uncertain terms” it didn’t indirectly or directly pay to obtain the decryptor.

Having a decryptor is a big help for organizations that didn’t have a good backup of their data or have an awkward backup process. However, it doesn’t help with the cost of rebuilding PCs, servers and networks to ensure the malware has been scrubbed.

Obtaining a decryptor is not the end of a trying time for Kaseya after the on-premises version of its VSA remote IT monitoring suite was infected by the REvil ransomware on July 2nd. It still isn’t exactly clear how the company was attacked. Most security researchers believe it was through one or more unpatched zero-day vulnerabilities within the product. Once they’d gained access, the attackers created a fake malicious automated update called “Kaseya VSA Agent Hot-fix,” which was pushed to VSA servers in Kaseya’s clients’ networks. The update disabled Kaseya VSA administrative access, allowing the REvil/Sodinokibi ransomware to be delivered, mostly to managed service providers. It was then in turn transmitted to up to 1,500 of their customers.

Although it was only the on-prem version of VSA that was affected, Kaseya took its cloud version of the software offline as a precaution.

It took until July 12th for Kaseya to update its cloud service and return it online as well as to issue patches for the on-prem version. Some functions were disabled in the patches to get customers up and running more quickly. It wasn’t until July 19th that fixes were issued that restored full functionality to VSA.

As for the Russian-based REvil gang, a ransomware-as-a-service operation with a number of affiliates who actually target and infiltrate victims, after it demanded multi-million dollar ransoms, its web sites disappeared. No one knows whether it has gone for good after being pressured by Russian authorities, or is just temporarily keeping a low profile.

 

 

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@] soloreporter.com

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now