Loading story…
Attackers exploited a code injection flaw in on-premises Kaseya VSA servers to distribute a malicious update through managed service providers, turning the remote management platform into a supply-chain delivery mechanism for REvil/Sodinokibi ransomware. Kaseya said victims numbered in the low thousands, while tens of thousands of customers reportedly shut down VSA servers as a precaution; reporting cited especially heavy impact in the UK, South Africa, and Canada. The intrusion chain used an encrypted file named agent.crt, pushed as a "Kaseya VSA Agent Hot-fix", then decoded it to agent.exe and launched the ransomware payload mpsvc.dll via DLL sideloading.
The malware sequence also attempted to disable Microsoft Defender protections before encryption, underscoring the importance of controls such as Defender tamper protection to prevent unauthorized security-setting changes. Response guidance included shutting down on-premises VSA servers, disabling VSA agents, backing up sensitive data, rotating credentials including krbtgt, and investigating for persistence, data theft, and lateral movement. Published indicators included file hashes, registry artifacts, log locations, and source IP addresses associated with curl/7.69.1 activity to help defenders scope exposure and hunt for compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
At least 36,000 customers reportedly took their servers offline in response to the ransomware incident. This reflected a broad defensive shutdown affecting organizations using Kaseya VSA.
Following the attack, Kaseya said the number of victims was in the low thousands. The incident was described as having especially significant impact in the UK, South Africa, and Canada.
In July 2021, attackers exploited a code injection vulnerability in on-premises Kaseya VSA servers to push malicious updates through managed service providers to downstream customer endpoints. The attack chain included delivery of an encrypted file named agent.crt, decoding it to agent.exe, disabling Microsoft Defender protections, and executing the REvil/Sodinokibi payload via DLL sideloading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil affiliates exploited four zero-day flaws in on-premises **Kaseya VSA** servers to turn a trusted remote management platform into a ransomware delivery channel for managed service providers and their customers. The attack chain reportedly included an authentication bypass, unrestricted file upload, CSRF bypass, and command injection, allowing attackers to upload malicious ASP code and push ransomware through VSA with administrator-level access. Researchers said the campaign abused Kaseya-mandated antivirus exclusions, used `agentmon.exe` to launch malicious commands, decoded payloads with a renamed `certutil`, and side-loaded a malicious DLL through a signed dropper and an outdated Microsoft Defender binary while disabling multiple Defender protections. The supply-chain attack encrypted local, removable, and mapped network drives across downstream environments, affecting about **60 MSPs** and roughly **1,500 businesses**, though REvil claimed a far larger device count and demanded **$70 million** for a universal decryptor. Red Canary said it detected the activity before the vulnerabilities were publicly known by spotting behavioral indicators such as Defender tampering and registry changes tied to REvil, then used containment actions including endpoint isolation and hash banning across multiple customer environments. Kaseya later patched the flaws in version `9.5.7a` and subsequently obtained a universal decryptor from a trusted third party, which it distributed to victims as the FBI and DOJ continued investigating the incident.
Aug 15, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026
REvil exploited a zero-day in on-premises **Kaseya VSA** servers to launch a supply-chain ransomware attack that spread through managed service providers and into downstream customer networks, ultimately affecting about 60 MSPs and roughly 1,500 businesses. Researchers reported the attackers used VSA’s privileged access to push a malicious script, attempted to disable Microsoft Defender, abused `certutil`, and side-loaded a malicious DLL using a legitimate `MsMpEng.exe` binary, enabling rapid encryption across victim environments. The gang demanded **$70 million** for a universal decryptor, while defenders published indicators of compromise and detection guidance tied to behaviors such as DLL sideloading and suspicious PowerShell and Windows event activity. A universal decryptor for the Kaseya-related campaign later emerged, but reporting showed the FBI had secretly obtained the key and withheld it for 19 days while weighing a broader operation against the Russia-linked REvil gang. During that delay, many victims restored from backups or absorbed recovery costs before Kaseya received the key on July 21 and worked with Emsisoft to release a decryptor the next day; Bitdefender later published a broader tool for some earlier REvil victims. The campaign-specific key was subsequently leaked on a hacking forum and verified by researchers, reinforcing that it worked for the Kaseya incident but was not a master key for all REvil infections.
Aug 15, 2026