A New Kind of Ransomware Tsunami Hits Hundreds of Companies

It was probably inevitable that the two dominant cybersecurity threats of the day— supply chain attacks and ransomware—would combine to wreak havoc. That’s precisely what happened Friday afternoon, as the notorious REvil criminal group successfully encrypted the files of hundreds of businesses in one swoop, apparently thanks to compromised IT management software. And that’s only the very beginning.

The situation is still developing and certain details—most important, how the attackers infiltrated the software in the first place—remain unknown. But the impact has already been severe and will only get worse given the nature of the targets. The software in question, Kaseya VSA, is popular among so-called managed service providers, which provide IT infrastructure for companies that would rather outsource that sort of thing than run it themselves. Which means that if you successfully hack an MSP, you suddenly have access to its customers. It’s the difference between cracking safe-deposit boxes one at a time and stealing the bank manager’s skeleton key.

So far, according to security company Huntress, REvil has hacked eight MSPs. The three that Huntress works with directly account for 200 businesses that found their data encrypted Friday. It doesn’t take much extrapolation to see how much worse it gets from there, especially given Kaseya’s ubiquity. “Kaseya is the Coca-Cola of remote management,” says Jake Williams, chief technology officer of the incident response firm BreachQuest. “Because we’re going into a holiday weekend, we won’t even know how many victims are out there until Tuesday or Wednesday of next week. But it’s monumental.”