Expel has also begun pushing out more generalized logic rules to catch variants of these attack vectors. Lastly, make sure you incorporate these learnings into your detection strategy.Īfter notifying our customers of the situation, Expel deployed “be on the lookout” detections – where customers are immediately notified of a detection – for the two known malicious hashes, and for the known file paths the attackers have been reportedly using. If you haven’t already done so, we recommend you immediately: There are also a few steps you can take right now to protect against this attack. Kaseya warned that links sent by the attackers “may be weaponized.” They’ve also shared a new Compromise Detection Tool to help determine if there are indicators of compromise on a VSA served or managed endpoint. What you can do right now to keep your org safeįirst and foremost – don’t click on any links!
MsMpEng.exe (legitimate Microsoft Defender copy).
The ransomware threat group REvil, also known as Sodinokibi, claimed responsibility.
#WHAT IS KASEYA AGENT SOFTWARE#
The ransomware was deployed through an automated malicious Kaseya VSA software update. Kaseya VSA, a remote monitoring and management (RMM) tool, was exploited via a zero-day vulnerability (CVE-2021–30116) to deploy ransomware to MSPs and at least hundreds of US businesses. Kaseya, an IT solutions company used by many Managed Security Providers (MSPs) and enterprise orgs, announced on Jthat it was the victim of a large-scale supply chain attack. And we’ll continue to do so in the face of events like this.
#WHAT IS KASEYA AGENT HOW TO#
The community rallied quickly, creating awareness and providing guidance on how to guard against this attack. So constantly evolving their tactics is an investment attackers are willing to make. Unlike the smaller payout bad actors may earn using cheap tactics, a sophisticated attack like this latest REvil ransomware attack can mean big money. There’s been a steep rise in supply chain ransomware attacks like this one since 2017, and we have no doubt that we’ll continue to see these types of attacks. What type of attack? You guessed it – ransomware. It was a few hours before the start of a holiday weekend, and attackers decided to strike.
0 kommentar(er)
