Over 200 US companies attacked by REvil, hackers demand $70 million in Bitcoin

REvil or Ransomware Evil has launched a large-scale ransomware attack, targeting hundreds of companies using outsourced IT services from Managed Service Providers (MSPs) of Kaseya VSA. The attack is currently one of the biggest known cyberattacks in the history of the world, considering the cost that is involved in the affected companies working around the encrypted data lost to the attack. 

REvil demands $70 million in Bitcoin

REvil also known as Sodinokibi is a cybercriminal group that runs private ransomware as a service (RaaS) operation. REvil recruits affiliates to distribute ransomware and splits revenue generated from ransom payments, with them. 

On July 2, REvil attacked end-user organizations using MSP providers of Kaseya. Kaseya offers industry-leading IT solutions through their IT Complete Product Suite and their family of companies like Unitrends, RapidFire Tools, Spanning Cloud Apps among others. 

Over 40,000 organizations worldwide avail Kaseya’s services. 

The attack did not directly affect the MSPs of Kaseya and instead targeted end-user organizations that remain undisclosed. The target companies found their data encrypted and this includes several small to medium-sized businesses since these are the companies that lack the resources to manage an IT infrastructure in-house. 

So far no company has come forward with details of the damage that this attack had on their data. However, the number of impacted companies is likely to increase according to John Hammon, a security researcher at US-based cybersecurity company, Huntress.

REvil has asked their targets for a ransom of $70 million in Bitcoin for publicly decrypting their data within an hour, based on their post on the Happy Blog, the cybercriminal group’s blog. 

In response to REvil’s ownership of the attack, Kaseya CEO, Fred Voccola was quoted saying,

Kaseya has done all the right things. We are waiting for a full report once this is resolved. We are really fortunate that this happened on the July 4 weekend when many of our customers are not working. If this had been a regular work week, it would have been a much bigger disaster.

Kaseya to launch patch for the zero-day vulnerability

Kaseya is currently assisting the affected companies in protecting their systems by offering the patch for installation, before restarting the VSA. 

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have been working with Kaseya and coordinating to conduct outreach to impacted victims. 

REvil’s attack is not yet attributed to the Russian Government, though it is confirmed that Bitcoin from REvil’s last hack on the world’s largest meat-packer JBS S.A on May 30 hit a darknet marketplace that exclusively caters to Russian users.

While the investigation continues, companies have the choice to recover from this incident by reinstating their data using backup. However, this poses a data privacy challenge since REvil claims to have access to the data of clients and may publish it on their blog or sell it on the darknet, in case of non-payment. This leaves companies with one choice, to pay the ransom and wait for REvil to decrypt their data. 

REvil’s last target, the world’s largest meat-packer JBS S.A. paid $11 million in Bitcoin as ransom to decrypt their data. 

The target companies have limited choices since this is a sophisticated cyberattack. The attack targeted a vulnerability that was zero-day, meaning it was less widely known. 

According to the chair of the Dutch institute for Vulnerability Disclosure, a software patch was made to fix this vulnerability, but it was not distributed to users yet. It would require a higher level of cybersecurity and technical sophistication for companies to protect themselves from such attacks in the future and to protect their systems from zero-day vulnerability exploits. 

Several companies have been stockpiling Bitcoin to cover all their bases, since 2017, according to cybersecurity experts and firms, in the event of a large-scale attack.