More is coming to light about the weekends Kaseya cyber attack, which looks like it came from a zero day following a patch release (CVE-2021–30116).

← Back to Blog

More is coming to light about the weekends Kaseya cyber attack, which looks like it came from a zero day following a patch release (CVE-2021¢â‚¬â€œ30116). If correct then it resembles the SolarWinds attack in 2020 and went straight in at source code through SDLC.

Delivery of ransomware is via an automated, fake, software update using Kaseya VSA. The attacker immediately stops administrator access to the VSA, and then adds a task called ¢â‚¬Å“Kaseya VSA Agent Hot-fix¢â‚¬Â. This fake update is then deployed across the estate ¢â‚¬â€ including on MSP client customers systems. The high level of privileges which Kaseya has mean it propagates around the estate. Allowing the attackers to remotely execute attacks.

Current advice is switch off the Kaseya VSA. Do not deploy any patches until told by Kaseya. With the attack spreading quickly and impacting such a large number of companies, I expect that the cyber insurance industry will be paying close attention. It’s been an interesting 9 months with significant global events reported including SolarWinds, Exchange hack, Colonial and JSB. All of which should provide the industry with valuable insight into ransomware attacks.

#cybersecurity‚ #SupplyChainRiskManagement‚ #CyberRiskManagement‚ #riskmanagement‚ #compliance‚ #cyberinsurance‚ #insurance‚ #regulatorycompliance‚ #regulatoryoversight‚ #esgrisk‚ #cyberregulation‚ #esgreporting‚ #soc2‚ #defenceindustry‚ #esg

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6818070508999852032