The Kaseya VMA ransomware incident

Kaseya announced on 7/2/21 that customers utilizing the Kaseya VSA solution on premise were targeted by this attack. It impacts consumers utilizing the VSA solution on premise. None of the SaaS consumers using the VSA solution are impacted. Kaseya VSA is a unified remote monitoring and management solution primarily used by MSSP and companies with larger infrastructures.

The attackers were able to exploit zero-day vulnerabilities in the VSA product to bypass authentication and run arbitrary command execution. This allowed the attackers to leverage the standard VSA product functionality to deploy ransomware to endpoints.

1. Indicators of compromise have been published from Kaseya and can be seen here.


2. A tool to identify indicators of compromise is located here.

1. Turn off your Kaseya instance. Stay tuned to the Kaseya incident page for updates on what steps to take next. All on-premises VSA Servers should continue to remain offline until further instructions from Kaseya about when it is safe to restore operations. A patch will be required to be installed prior to restarting the VSA and a set of recommendations on how to increase your security posture.

1. Kaseya is currently working on a software patch that must be installed prior to the restoration of the impacted Kaseya solution.