World's Single-Biggest Ransomware Attack Hit 'Thousands' in 17 Countries

BlueHacker · 2021-07-05T14:41:00Z

https://storage.googleapis.com/afs-prod/media/83fa884a652441f59467072488b7b17b/800.jpeg It's now being called "[the single biggest global ransomware attack on record](https://apnews.com/article/joe-biden-europe-government-and-politics-technology-business-fc0df4c42f8cd6148bf936ca24bb5cbe)," with *thousands* of victims in at least 17 different countries breached with ransomware Friday, reports the Associated Press, citing new details provided by cybersecurity researchers. An affiliate of the Russia-linked gang REvil deployed the ransomware "largely through firms that remotely manage IT infrastructure for multiple customers." A broad array of businesses and public agencies were hit by the latest attack, apparently on all continents, including in financial services, travel and leisure and the public sector — though few large companies, the cybersecurity firm Sophos reported... The Swedish grocery chain Coop said most of its 800 stores would be closed for a second day Sunday because their cash register software supplier was crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT were also hit. In Germany, an unnamed IT services company told authorities several thousand of its customers were compromised, the news agency dpa reported... CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like "dental practices, architecture firms, plastic surgery centers, libraries, things like that." Voccola said in an interview that only between 50-60 of the company's 37,000 customers were compromised. But 70% were managed service providers who use the company's hacked VSA software to manage multiple customers. It automates the installation of software and security updates and manages backups and other vital tasks... Dutch researchers said they alerted Miami-based Kaseya to the breach and said the criminals used a "zero day," the industry term for a previously unknown security hole in software. Voccola would not confirm that or offer details of the breach — except to say that it was not phishing. "The level of sophistication here was extraordinary," he said. When the cybersecurity firm Mandiant finishes its investigation, Voccola said he is confident it will show that the criminals didn't just violate Kaseya code in breaking into his network but also exploited vulnerabilities in third-party software... Kaseya, which called on customers Friday to shut down their VSA servers immediately, said Sunday it hoped to have a patch in the next few days. The attacks may have been timed to exploit America's three-day weekend celebrating the nation's founding, according to experts interviewed by the Associated Press. America's National Security advisor is now urging all who believed they were compromised to [alert the FBI](https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-kaseya-ransomware-attack). "The attack comes less than a month after Biden pressed Russian President Vladimir Putin to stop providing safe haven to REvil and other ransomware gangs whose [unrelenting extortionary attacks](https://apnews.com/article/joe-biden-europe-government-and-politics-technology-business-3b81e8116c42439566040a052617ad55) the U.S. deems a national security threat." **UPDATE:** Bleeping Computer notes the exploited vulnerability "[had been previously disclosed to Kaseya by security researchers](https://www.bleepingcomputer.com/news/security/kaseya-was-fixing-zero-day-just-as-revil-ransomware-sprung-their-attack/) from the Dutch Institute for Vulnerability Disclosure (DIVD), and Kaseya was validating the patch before they rolled it out to customers." In a statement today, DIVD posted that "During the last 48 hours, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2,200 to [less than 140 in our last scan today](https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/)... A good demonstration of how a cooperative network of security-minded organizations can be very effective during a nasty crisis."

News & Articles

Chuck_Y July 5, 2021, 6:03pm 2

Thanks to @TheStrength I got this covered:
https://onehack.st/t/the-best-database-breach-lookup-sites/192747#:~:text=The%20Best%20Database%20Breach%20Lookup%20Sites

Topic	Replies	Views
Here's a list of all the ransomware gangs who will steal and leak your data if you don't pay News & Articles hacking , data-recovery	987	June 6, 2020
2021 Has Broken the Record For Zero-Day Hacking Attacks News & Articles programming , hacking	939	September 24, 2021
Ransomware gang says it breached one of NASA's IT contractors News & Articles hacking , business	758	June 6, 2020
Ransomware team extorted $42 million from New York law firm, threatened to leak Trump scandal without giving money News & Articles hacking	1009	June 2, 2020
Ransomware Gangs That Steal Your Data Don't Always Delete It News & Articles hacking	886	November 7, 2020

World's Single-Biggest Ransomware Attack Hit 'Thousands' in 17 Countries

Related topics