Loading story…
Attackers leveraged trusted remote management software in two separate supply chain intrusions, including a ransomware case tied to Kaseya VSA and a credential-dumping operation delivered through a Desktop Central agent. In the Kaseya-linked incident, the intrusion chain used the Kaseya agent to create and decode malicious payloads, attempted to disable Microsoft Defender protections, and dropped ransomware-related components including agent.exe and MsMpEng.exe.
In the second intrusion, the attackers used the Desktop Central agent to gain footholds, established persistence with scheduled tasks, forwarded traffic with GO Simple Tunnel, and deployed setup0.exe alongside elevateutils.exe, which analysis identified as a Cobalt Strike Beacon Malleable C2 stager communicating with vmware[.]center. Investigators contained the activity through root-cause analysis, IOC hunting, and endpoint isolation, underscoring how centralized management platforms can become high-impact supply chain attack vectors if not closely monitored and hardened.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
One of the investigated incidents was tied to the Kaseya VSA ransomware incident. Trend Micro states this case was associated with the July 2 Kaseya event, in which attackers abused the Kaseya agent execution chain to deliver ransomware components.
After identifying affected hosts in the second incident, the MDR team added malicious IP addresses and hashes to a suspicious objects block list. They also recommended reviewing application logon logs for suspicious account use.
Root cause analysis in the second case found that setup0.exe created elevateutils.exe, with the earliest observed setup0.exe located on one affected host. Investigators assessed elevateutils.exe as a Cobalt Strike Beacon Malleable C2 stager communicating with vmware[.]center and concluded the malicious file had been deployed through a Desktop Central agent.
Threat hunting in the second incident identified suspicious WmiExec behavior and a scheduled task created with schtasks.exe to run powershell.exe C:\Windows\System.exe with network-forwarding arguments. Analysis linked System.exe to GO Simple Tunnel, indicating the attackers had established persistence and traffic-forwarding capability.
In a separate supply-chain case, investigators began with an alert about credential dumping in an Active Directory environment. Incident aggregation linked a server, an endpoint, and a user to the activity.
After the Kaseya-related attack, Kaseya told users to immediately shut down their Virtual System/Server Administrator servers until further notice. This was an official response aimed at containing the supply-chain compromise.
Trend Micro's MDR team alerted a customer after detecting ransomware activity in its environment during the Kaseya incident. The investigation found malicious use of AgentMon.exe, cmd.exe, certutil-based payload decoding, attempts to disable Windows Defender protections, and ransomware files including agent.exe and MsMpEng.exe; the team advised isolating Kaseya servers.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited a code injection flaw in on-premises **Kaseya VSA** servers to distribute a malicious update through managed service providers, turning the remote management platform into a supply-chain delivery mechanism for **REvil/Sodinokibi** ransomware. Kaseya said victims numbered in the low thousands, while tens of thousands of customers reportedly shut down VSA servers as a precaution; reporting cited especially heavy impact in the UK, South Africa, and Canada. The intrusion chain used an encrypted file named `agent.crt`, pushed as a **"Kaseya VSA Agent Hot-fix"**, then decoded it to `agent.exe` and launched the ransomware payload `mpsvc.dll` via DLL sideloading. The malware sequence also attempted to disable **Microsoft Defender** protections before encryption, underscoring the importance of controls such as Defender tamper protection to prevent unauthorized security-setting changes. Response guidance included shutting down on-premises VSA servers, disabling VSA agents, backing up sensitive data, rotating credentials including **`krbtgt`**, and investigating for persistence, data theft, and lateral movement. Published indicators included file hashes, registry artifacts, log locations, and source IP addresses associated with `curl/7.69.1` activity to help defenders scope exposure and hunt for compromise.
Jul 22, 2026
REvil affiliates exploited four zero-day flaws in on-premises **Kaseya VSA** servers to turn a trusted remote management platform into a ransomware delivery channel for managed service providers and their customers. The attack chain reportedly included an authentication bypass, unrestricted file upload, CSRF bypass, and command injection, allowing attackers to upload malicious ASP code and push ransomware through VSA with administrator-level access. Researchers said the campaign abused Kaseya-mandated antivirus exclusions, used `agentmon.exe` to launch malicious commands, decoded payloads with a renamed `certutil`, and side-loaded a malicious DLL through a signed dropper and an outdated Microsoft Defender binary while disabling multiple Defender protections. The supply-chain attack encrypted local, removable, and mapped network drives across downstream environments, affecting about **60 MSPs** and roughly **1,500 businesses**, though REvil claimed a far larger device count and demanded **$70 million** for a universal decryptor. Red Canary said it detected the activity before the vulnerabilities were publicly known by spotting behavioral indicators such as Defender tampering and registry changes tied to REvil, then used containment actions including endpoint isolation and hash banning across multiple customer environments. Kaseya later patched the flaws in version `9.5.7a` and subsequently obtained a universal decryptor from a trusted third party, which it distributed to victims as the FBI and DOJ continued investigating the incident.
Aug 15, 2026
Initial access brokers advertised and sold access to dozens of organizations through **Zoho ManageEngine Desktop Central**, turning a legitimate remote monitoring and management platform into a high-value entry point for ransomware operations. KELA tracked **53 access listings** between July and September 2020 with a combined asking price of **$153,850**, and said at least **10** had already been sold. Victims spanned multiple countries and sectors, including government organizations, while some of the highest-priced listings were tied to companies in Turkey and Canada. Researchers assessed that the compromises were more likely caused by direct attacks against exposed Desktop Central instances and the use of valid credentials than by a single managed service provider breach. The sales fit a broader underground market in which brokers monetized enterprise footholds for follow-on attacks, including ransomware deployment. KELA later counted **242 network access listings** worth about **$1.21 million** in Q4 2020, with common offerings including **RDP**, **VPN**, **Citrix**, **RCE**, and increasingly **RMM**-based access. The appeal of Desktop Central was its ability to provide remote control and script execution across many endpoints, enabling rapid domain-wide compromise; a separate DFIR case involving **NetWalker** showed how quickly ransomware operators could move from initial access to full encryption. Zoho said weak credentials were the likely cause in the investigated Desktop Central cases and moved to block future logins using weak passwords.
Aug 15, 2026