- Russia-based ransomware group REvil brought down the network of over 200 U.S. companies and demanded Bitcoin worth $70 million.
- The attack spread to over 1 million machines that were running supply chain software provided by Kaseya.
- REvil targeted a zero-day vulnerability in Kaseya’s system to launch a sophisticated cyberattack.
REvil or Ransomware Evil has launched a large-scale ransomware attack, targeting hundreds of companies using outsourced IT services from Managed Service Providers (MSPs) of Kaseya VSA. The attack is currently one of the biggest known cyberattacks in the history of the world, considering the cost that is involved in the affected companies working around the encrypted data lost to the attack.
REvil demands $70 million in Bitcoin
REvil also known as Sodinokibi is a cybercriminal group that runs private ransomware as a service (RaaS) operation. REvil recruits affiliates to distribute ransomware and splits revenue generated from ransom payments, with them.
On July 2, REvil attacked end-user organizations using MSP providers of Kaseya. Kaseya offers industry-leading IT solutions through their IT Complete Product Suite and their family of companies like Unitrends, RapidFire Tools, Spanning Cloud Apps among others.
Over 40,000 organizations worldwide avail Kaseya’s services.
The attack did not directly affect the MSPs of Kaseya and instead targeted end-user organizations that remain undisclosed. The target companies found their data encrypted and this includes several small to medium-sized businesses since these are the companies that lack the resources to manage an IT infrastructure in-house.
So far no company has come forward with details of the damage that this attack had on their data. However, the number of impacted companies is likely to increase according to John Hammon, a security researcher at US-based cybersecurity company, Huntress.
REvil has asked their targets for a ransom of $70 million in Bitcoin for publicly decrypting their data within an hour, based on their post on the Happy Blog, the cybercriminal group’s blog.
In response to REvil’s ownership of the attack, Kaseya CEO, Fred Voccola was quoted saying,
Kaseya has done all the right things. We are waiting for a full report once this is resolved. We are really fortunate that this happened on the July 4 weekend when many of our customers are not working. If this had been a regular work week, it would have been a much bigger disaster.
Kaseya to launch patch for the zero-day vulnerability
Kaseya is currently assisting the affected companies in protecting their systems by offering the patch for installation, before restarting the VSA.
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have been working with Kaseya and coordinating to conduct outreach to impacted victims.
REvil’s attack is not yet attributed to the Russian Government, though it is confirmed that Bitcoin from REvil’s last hack on the world’s largest meat-packer JBS S.A on May 30 hit a darknet marketplace that exclusively caters to Russian users.
While the investigation continues, companies have the choice to recover from this incident by reinstating their data using backup. However, this poses a data privacy challenge since REvil claims to have access to the data of clients and may publish it on their blog or sell it on the darknet, in case of non-payment. This leaves companies with one choice, to pay the ransom and wait for REvil to decrypt their data.
REvil’s last target, the world’s largest meat-packer JBS S.A. paid $11 million in Bitcoin as ransom to decrypt their data.
The target companies have limited choices since this is a sophisticated cyberattack. The attack targeted a vulnerability that was zero-day, meaning it was less widely known.
According to the chair of the Dutch institute for Vulnerability Disclosure, a software patch was made to fix this vulnerability, but it was not distributed to users yet. It would require a higher level of cybersecurity and technical sophistication for companies to protect themselves from such attacks in the future and to protect their systems from zero-day vulnerability exploits.
Several companies have been stockpiling Bitcoin to cover all their bases, since 2017, according to cybersecurity experts and firms, in the event of a large-scale attack.
Information on these pages contains forward-looking statements that involve risks and uncertainties. Markets and instruments profiled on this page are for informational purposes only and should not in any way come across as a recommendation to buy or sell in these assets. You should do your own thorough research before making any investment decisions. FXStreet does not in any way guarantee that this information is free from mistakes, errors, or material misstatements. It also does not guarantee that this information is of a timely nature. Investing in Open Markets involves a great deal of risk, including the loss of all or a portion of your investment, as well as emotional distress. All risks, losses and costs associated with investing, including total loss of principal, are your responsibility. The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of FXStreet nor its advertisers. The author will not be held responsible for information that is found at the end of links posted on this page.
If not otherwise explicitly mentioned in the body of the article, at the time of writing, the author has no position in any stock mentioned in this article and no business relationship with any company mentioned. The author has not received compensation for writing this article, other than from FXStreet.
FXStreet and the author do not provide personalized recommendations. The author makes no representations as to the accuracy, completeness, or suitability of this information. FXStreet and the author will not be liable for any errors, omissions or any losses, injuries or damages arising from this information and its display or use. Errors and omissions excepted.
The author and FXStreet are not registered investment advisors and nothing in this article is intended to be investment advice.
Recommended Content
Editors’ Picks
Top 3 Price Prediction Bitcoin, Ethereum, Ripple: BTC experiences volatility post $100K milestone
Bitcoin rebounds to $97,000 on Friday after a volatile drop to $90,500, following its $100K milestone the day before. Ethereum maintains bullish momentum above key support levels, signaling a potential rally toward $4,000. In contrast, Ripple exhibits bearish tendencies, hinting at further declines.
XRP chosen alongside Bitcoin as treasury assets for Nasdaq-listed Worksport
Ripple's XRP is down 5% on Thursday following an announcement from Tonneau cover manufacturer Worksport that it would add the remittance-based token as part of its corporate treasury.
Gamestop, GME meme coin surge following Roaring Kitty return
Gamestop-based meme coins rose more than 40% on Thursday after popular trader, Keith Gill, stirred excitement in the meme coin sector with a post featuring a Time Magazine picture on social media platform X.
Ethereum Price Forecast: ETH overcomes key hurdle as ETF and staking inflows improve
Ethereum is down 1% on Thursday despite rallying in the European session to overcome a key descending trendline resistance that has lasted for three years. The top altcoin has seen increased bullish sentiment across staking protocols and ETH ETFs.
Bitcoin: A healthy correction
Bitcoin (BTC) experienced a 7% correction earlier in the week, dropping to $90,791 on Tuesday before recovering to $97,000 by Friday. On-chain data suggests a modest rebound in institutional demand, with holders buying the dip. A recent report indicates BTC remains undervalued, projecting a potential rally toward $146K.
Best Forex Brokers with Low Spreads
VERIFIED Low spreads are crucial for reducing trading costs. Explore top Forex brokers offering competitive spreads and high leverage. Compare options for EUR/USD, GBP/USD, USD/JPY, and Gold.