The Kaseya VSA Attack of 2021: One Tool, Fifteen Hundred Victims
In July 2021 REvil abused Kaseya's remote management tool to hit service providers and their customers. See how it spread and what it means for agencies.
On Friday 2 July 2021, just ahead of the US Independence Day holiday weekend, a ransomware attack began to spread through a type of company most people never think about: managed service providers. By abusing a flaw in Kaseya VSA, a remote management tool used to look after customers' computers, the REvil criminal group reached many businesses at once. It showed how one trusted tool can multiply an attack.
What Kaseya VSA does
Managed service providers, or MSPs, look after the IT of many small and mid-sized businesses. To do that efficiently, they use remote monitoring and management software that can install updates, run scripts and fix problems on all of their customers' computers from one console. Kaseya VSA is one such product. That power is exactly what makes it attractive to an attacker: whoever controls the console can run commands on every machine it manages.
How the attack worked
The attackers exploited a previously unknown vulnerability in VSA, later given the identifier CVE-2021-30116, which allowed them to bypass authentication on servers that were exposed to the internet. Through it, they used the software's own update mechanism to send a malicious package to the computers managed by affected MSPs. That package deployed the REvil ransomware, which encrypted files on the machines.
Kaseya said that around 60 of its customers were directly affected, and that the total number of downstream businesses hit was fewer than 1,500. Many of those were small companies, such as dental offices and local firms. The best known impact was in Sweden, where the supermarket chain Coop closed hundreds of stores for several days because its tills stopped working, even though Coop was not a Kaseya customer; its software supplier was.
A race against a fix
The Dutch Institute for Vulnerability Disclosure had earlier reported a set of flaws in VSA to Kaseya, and the company was working on fixes. The institute said that the attackers struck before the patch was released. Kaseya advised customers to shut down their VSA servers immediately and later released patches and guidance. It is a reminder that even good coordination can lose to a determined attacker.
The ransom demand
REvil offered a universal decryption key in return for 70 million dollars in bitcoin, an unusually large demand that looked aimed at making a statement. It also offered individual deals to victims. Kaseya did not pay, and on 21 July it said it had obtained a universal decryptor from a trusted third party, which it provided to affected customers. REvil's sites disappeared from the internet in mid-July, before briefly reappearing in September. In late 2021 US authorities announced charges against a Ukrainian man alleged to have carried out the Kaseya attack, who was arrested in Poland.
Why this model is dangerous
| Feature | Risk |
|---|---|
| One console controls many machines | A single flaw affects many customers |
| Tool runs with high privileges | Malicious commands run with full rights |
| Management server exposed to the internet | Attackers can reach and test it directly |
| Customers trust the provider | Little scrutiny of what the tool does |
Agencies and resellers carry extra responsibility
If you build or manage websites for clients, you are in a similar position to an MSP. A single dashboard, password manager or hosting reseller account may control dozens of sites. That is efficient, and it also means that a stolen login or a compromised tool can affect all of your clients at once. The Kaseya case argues for strict control of who can log in to the management layer, for keeping it patched and for limiting what it is allowed to do.
The holiday timing
The attack was launched on the Friday before a long US holiday weekend, when many security teams were thinking about time off. This is a pattern seen again and again in ransomware incidents: attackers favour weekends, holidays and the hours before a break, because staffing is thin and a response is slower. In Kaseya's case, the company's own team responded quickly, and its warning to shut down servers probably limited the spread, but customers in other time zones were already affected.
For a small business, this suggests two habits. Make sure someone can be reached at short notice if your site goes down, and check before a holiday that updates are applied, backups have run and no urgent security notices are waiting. Taking ten minutes before you leave for a break is far cheaper than dealing with a crisis from the beach.
The practical lesson for site owners
Secure the account that controls everything else: use two-factor authentication, unique passwords and restricted access for your control panel and any management tools. Keep each client's site in its own account where possible, so a problem in one does not spread to the others. Keep tested backups away from the systems the management tool can reach.
Agencies can look at our reseller hosting, which separates customer sites into their own accounts, and our security page for related protections.
