Datashield Security Advisory:

Kaseya VSA

Released: July 2, 2021

Datashield has been monitoring a reported supply chain attack on Kaseya VSA, an RMM tool popular with MSPs. This was first reported in various MSP community channels (Discord, Reddit) with very limited information, although throughout the day, credible details have been released.

Presently, it appears Kaseya was targeted by known threat actor REVil, which is using the Kaseya VSA infrastructure to perpetuate a mass infection of ransomware. This threat is still developing, although some IOCs are available.

Datashield does not use Kaseya VSA, although we are working to build detection content and acquire further information from partners and intelligence sources. Current IOCs are heavily host-based, so network-based detection of post-infection traffic may be limited until more post-compromise indicators are uncovered, evaluated, and implemented in our threat detection content. Please note, all available IOCs have already been added to detection content in ShieldVision.

Guidance from Kaseya VSA is to immediately disconnect and shut down any VSA servers currently connected to your network.

Kaseya notice:

• Kaseya VSA Helpdesk - Informational 

Indicators of Compromise (IOCs):

• https://www.virustotal.com/gui/file/8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd/details

  • a47cf00aedf769d60d58bfe00c0b5421

  • 656c4d285ea518d90c1b669b79af475db31e30b1

  • 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd

• https://www.virustotal.com/gui/file/d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e/detection

  • 561cffbaba71a6e8cc1cdceda990ead4

  • 5162f14d75e96edb914d1756349d6e11583db0b0

  • d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e

• https://www.virustotal.com/gui/file/e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2/detection

  • 7ea501911850a077cf0f9fe6a7518859

  • e1d689bf92ff338752b8ae5a2e8d75586ad2b67b

  • e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2

If you have any questions regarding this vulnerability, please contact us below.