Kaseya VSA products are being actively attacked by REvil supply chain attack with ransomware

On July 2, Kaseya's VSA remote monitoring and management platform are being actively attacked by REvil ransomware actors (attackers) and conduct supply-chain attack targeting multiple Managed Service Providers (MSPs) and their customers.

Kaseya is used by multiple MSPs, the affected organisations are being contacted by Kaseya directly.

Incident Summary:

1. The REvil ransomware gang appears to have gained unauthorised access to the infrastructure of Kaseya.
2. It enabled them to deploy a malicious update to Kaseya's VSA servers.
3. The malicious updates was used to install the REvil ransomware from the VSA Server to all connected computers.
4. It is reported that some of the victims received demands for $5 million in ransom. A retailer in Sweden was forced to close at least 800 stores due to the attack. 
5. Kaseya developed a compromise detection tool and is working on the security patch.

[Updated 12-July-2021] Security updates have been released to address CVE-2021-30116, CVE-2021-30119 and CVE-2021-30120 vulnerabilities.