how it happened
- whoREvilzero-day in VSA
- the gapremote management tooltrusted by service providers
- the result800 to 1,500 businesses$70M demand
what everyone assumed
Security feels like a perimeter you maintain: patch your systems, harden your stack, mind your own house. The assumption is that diligence on what you control is what determines your exposure.
what happened
Attackers exploited a zero-day in the remote-management platform and pushed ransomware downstream through the service providers into their customers’ systems. The victims had done nothing wrong and had no way to stop it; the privileged tool they trusted carried the attack to them.
step by step
- service providers manage clients through Kaseya VSAA privileged tool trusted downstream.
- REvil exploits a zero-day in itThe tool itself becomes the delivery route.the assumption breaks here
- July 2021ransomware reaches 800 to 1,500 businessesThrough roughly 60 providers.
- a $70 million demandThe victims did nothing wrong.
how it surfaced
In July 2021 the REvil group used the Kaseya VSA flaw to reach an estimated 800 to 1,500 downstream businesses through roughly 60 service providers, demanding $70 million. Diligence on one’s own systems was no defense.
Your exposure includes every privileged tool and provider with reach into your systems, not just the systems you patch yourself.
Someone else’s vulnerability, in software you trusted with deep access, is your incident.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAttackers break into the remote tool itself.what it costs youThey push ransomware to your machines, and to every other client of your provider, at once.
- or it goes like thisit happenedUS Treasury and BeyondTrust, 2024howThe master key of a remote-support product is stolen.what leavesstaff computers and the documents on themwho ends up with ita state-sponsored group
- or it goes like thisit happenedOkta / Lapsus$, 2022howA support contractor's laptop is taken over for a short while.what leavesreach into customer accountswho ends up with itan extortion gang posting screenshots
sources
your turn
what you can do about it
this week
Count the tools and vendors with standing privileged access into your environment.
Count the tools and vendors that hold privileged, standing access into your environment: the RMM, the backup agent, the monitoring platform, the MSP. Each is a path Kaseya-style. Knowing what they can reach, and reviewing it, is the work that patching your own stack does not cover.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →