Kaseya apologises for extended downtime after ransom attack

“It has been a long, long five days for everyone, and I want to express my sincere apologies that you’re not up on VSA, that VSA is not accessible for you to serve your customers, to serve your internal IT folks, and to make your lives easier,” said Voccola. “I recognise … this sucks. We take this very seriously.

“The fact that we had to take down VSA was very disappointing to me… I feel like I let this community down, I let my company down, our company let you down,” he said.

“The new release time, which we are very confident in, is going to be this Sunday [11 July] in the early afternoon Eastern Standard Time,” added Voccola.

Voccola said he took responsibility for having pulled the planned release this week and described it as the hardest decision he’d had to make in his career.

“The fact that we had to take down VSA was very disappointing to me… I feel like I let this community down, I let my company down, our company let you down”

Kevin Voccola, Kaseya

He said Kaseya’s teams had locked down the vulnerabilities exploited in the attack and felt comfortable with the release, but, on the advice of third-party cyber consultants and Kaseya’s own engineers, they wanted to take time to put additional protections in place and harden VSA as much as possible.

Kaseya was downed late in the day on Friday 2 July by the REvil gang, ahead of a holiday weekend for the US company.

Between 50 and 60 of its managed service provider (MSP) customers were hit, with the cumulative impact spreading to thousands of downstream businesses – many of them small ones – that rely on the IT channel for their tech resource.

Most notably, the Swedish Coop supermarket chain was forced to shut hundreds of stores due to its payment systems dropping offline.

The ransomware operators have demanded $70m for a master decryption key, and far smaller sums from individual victims (see image below), but Voccola has been vocal in his refusal to negotiate with the criminals. It is not known if any of the other impacted businesses have entered negotiations.

In the past 24 hours, more details have begun to emerge via the Dutch Institute for Vulnerability Disclosure (DIVD) of the precise vulnerabilities exploited by REvil.

DIVD said it had been working extensively behind the scenes on seven newly discovered common vulnerabilities and exposures (CVEs) in the VSA product since 6 April.

These are CVE-2021-30116, a credential leak and business logic flaw; CVE-2021-30117, a SQL injection vulnerability; CVE-2021-30118, a remote code execution (RCE) vulnerability; CVE-2021-30119, a cross-site scripting (XSS) vulnerability; CVE-2021-30120, a two-factor authentication (2FA) bypass; CVE-2021-30121, a local file inclusion vulnerability; and CVE-2021-30201, an XML external entity vulnerability.

Of these, 30117, 30118, 30121 and 30201 have been resolved in previous patches, from which one can now infer that REvil used one or more of 30116, 30119 and 30120 to access the target systems.

DIVD’s chairman, Victor Gevers, said that, throughout the process, Kaseya had shown that it was willing to put maximum effort and initiative into getting the issue fixed and its customers patched.

“[Kaseya] showed a genuine commitment to do the right thing,” he said. “Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch.”