Who’s behind the Kaseya ransomware attack – and why is it so dangerous?
Hackers last week infiltrated a Floridabased information technology firm and deployed a ransomware attack, seizing troves of data and demanding $70m in payment for its return.
The hack of the Kaseya firm, which is already being called “the biggest ransomware attack on record”, has affected hundreds of businesses globally, including supermarkets in Sweden and schools in New Zealand.
In the aftermath of the attack, cybersecurity teams are scrambling to regain control of the stolen data while the Biden administration is mulling potential diplomatic responses. Here’s what you need to know about the attack, its impact, and what’s next.
What happened and what makes this hack particularly bad?
Hackers infiltrated Kaseya, accessed its customers’ data, and demanded ransom for the data’s return. Making the hack particularly grave, experts say, is that Kaseya is what is known as a “managed service provider”. That means its systems are used by companies too small or modestly resourced to have their own tech departments. Kaseya regularly pushes out updates to its customers meant to ensure the security of their systems. But in this case, those safety features were subverted to push out malicious software to customers’ systems.
This hack was particularly egregious because the bad actors behind it had targeted the very systems typically used to protect customers from malicious software, said Doug Schmidt, a professor of computer science at Vanderbilt University.
“This is very scary for a lot of reasons – it’s a totally different type of attack than what we have seen before,” Schmidt said. “If you can attack someone through a trusted channel, it’s incredibly pervasive – it’s going to ricochet way beyond the wildest dreams of the perpetrator.”
Who was affected?
Kaseya has said that between 800 and 1,500 businesses were affected by the hack, although independent researchers have pegged the figure at closer to 2,000. There are at least 145 victims in the US, according to an outside analysis from Sophos Labs, including local and state governments and agencies as well as small and medium-sized businesses.
Joe Biden said on Tuesday that while a number of smaller US businesses like dentists’ offices or accountants might have felt the effects of the hack, not many domestic companies had been affected.
“It appears to have caused minimal damage to US businesses, but we’re still gathering information,” Biden told reporters following a briefing from advisers. “I feel good about our ability to be able to respond.”
Meanwhile, the impact has reached other continents, and the disruption has been felt more keenly in other countries. In Sweden, hundreds of supermarkets had to close when their cash registers were rendered inoperative and in New Zealand, many schools and kindergartens were knocked offline.
Who is behind the hack?
Affiliates of the Russian hacker group REvil have claimed responsibility for the attack. REVil is the group that in June unleashed a major ransomware attack on the meat producer JBS, crippling the company and its supply until it paid a $11m ransom.
REvil has quickly become a huge operation, offering “ransomware as a service” – meaning it leases out its ability to extort companies to other criminals and keeps a percentage of each payment. Its business operates at scale, offering customer service hotlines to allow its victims to pay ransoms more easily.
What happens next?
Kaseya’s chief executive officer, Fred Voccola, told Reuters he could not confirm whether Kaseya would pay the $70m ransom or negotiate with the hackers for a lower cost: “No comment on anything to do with negotiating with terrorists in any way,” he said.
If the ransom were paid, it could exacerbate a ransomware arms race, said Schmidt. When hackers were successful, he said, they accrued more financial resources, enabling them to acquire better equipment, improved operations, and more skilled hackers.
“When hackers are assured they are going to get paid, and not going to get caught, they get a lot more brazen,” he said. “We are going to see a major, major escalation in these kinds of attacks. This is going to get a lot worse.”
In addition to the attacks by REvil on Kaseya and JBS in recent weeks, another Russia-linked group in May attacked the US fuel transporter Colonial Pipeline. It was revealed on Tuesday that the US Republican National Committee may have been affected by a breach carried out by yet another Russia-based hacking collective.
As attacks escalate, the Biden administration has discussed its domestic and international responses. The White House press secretary, Jen Psaki, said in a press conference on Tuesday that Biden would meet with officials from the departments of justice, state and homeland security and the intelligence community on Wednesday to discuss ransomware and US efforts to counter it.
She also said that senior US officials would meet their Russian counterparts next week to discuss the ransomware problem.
“As the president made clear to President Putin when they met, if the Russian government cannot or will not take action against criminal actors in Russia, we will take action or reserve the right,” she said.