WASHINGTON, July 2 (Reuters) – Hundreds of American businesses were hit Friday by an unusually sophisticated ransomware attack that hijacked widely used technology management software from a Miami-based supplier called Kaseya.
The attackers changed a Kaseya tool called VSA, used by companies that manage technology at smaller businesses. They then encrypted the files of those providers’ customers simultaneously.
Security firm Huntress said it was tracking eight managed service providers that had been used to infect some 200 clients.
Kaseya said on its own website that it was investigating a “potential attack” on VSA, which is used by IT professionals to manage servers, desktops, network devices and printers.
It said it shut down some of its infrastructure in response and that it was urging customers that used VSA on their premises to immediately turn off their servers.
“This is a colossal and devastating supply chain attack,” Huntress senior security researcher John Hammond said in an email, referring to an increasingly high profile hacker technique of hijacking one piece of software to compromise hundreds or thousands of users at a time.
Hammond added that because Kaseya is plugged in to everything from large enterprises to small companies “it has the potential to spread to any size or scale business.” Many managed service providers use VSA, although their customers may not realize it, experts said.
Some employees at service providers said on discussion boards that their clients had been hit before they could get a warning to them.
Reuters was not able to reach a Kaseya representative for further comment. Huntress said it believed the Russia-linked REvil ransomware gang – the same group of actors blamed by the FBI for paralyzing meat packer JBS (JBSS3.SA) last month – was to blame for the latest ransomware outbreak.
By Raphael Satter and Joseph Menn
