Kaseya obtains universal REvil decryptor
There’s finally some good news for the MSPs and their customers that have been hit by the REvil ransomware gang via compromised Kaseya VSA software: a universal decryptor has made it available to affected organizations.
“We can confirm that Kaseya obtained the tool from a third party and have teams actively helping customers affected by the ransomware to restore their environments, with no reports of any problem or issues associated with the decryptor,” the company announced on Thursday.
“Kaseya is working with Emsisoft to support our customer engagement efforts, and Emsisoft has confirmed the key is effective at unlocking victims.”
Attack progression
On July 2, 2021, the REvil gang exploited a vulnerability in Kaseya’s (on-premises) VSA (Virtual System Administrator) software to spread ransomware to a myriad of hosts belonging organizations of many types and sizes.
The exact number of affected organizations is unknown, but Kaseya estimated that “fewer than 1,500 downstream businesses” have been hit.The ransomware gang asked for $70 million to decrypt the locked systems.
In the meantime, for reasons unknown, their websites and other infrastructure “went dark” on July 13, leaving affected users who might have wanted to pay the ransom without the possibility of contact.
Cleaning the mess
Kaseya has declined to name the third party that delivered the REvil decryptor, or to say whether they paid the ransom.
It is also unknown whether any of the victimized organizations have paid the gang off, but many have resolved the compromise by restoring hosts (and data) from backups and rebuilding their networks. Those that haven’t been able to can now take advantage of Kaseya’s offer.
Since the hit, Kaseya has been working on fixing the exploited VBA vulnerabilities and has been releasing patches and new versions of VSA SaaS and On-Premises. The latest patch has been released on July 19, to remediate “functionality issues caused by the enhanced security measures put in place” and fix some bugs.
The company is dedicated to updating the VSA SaaS instances and customers with on-premises deployments are advised to implement offered patches / updates as they are released.