Loading story…
REvil exploited a zero-day in on-premises Kaseya VSA servers to launch a supply-chain ransomware attack that spread through managed service providers and into downstream customer networks, ultimately affecting about 60 MSPs and roughly 1,500 businesses. Researchers reported the attackers used VSA’s privileged access to push a malicious script, attempted to disable Microsoft Defender, abused certutil, and side-loaded a malicious DLL using a legitimate MsMpEng.exe binary, enabling rapid encryption across victim environments. The gang demanded $70 million for a universal decryptor, while defenders published indicators of compromise and detection guidance tied to behaviors such as DLL sideloading and suspicious PowerShell and Windows event activity.
A universal decryptor for the Kaseya-related campaign later emerged, but reporting showed the FBI had secretly obtained the key and withheld it for 19 days while weighing a broader operation against the Russia-linked REvil gang. During that delay, many victims restored from backups or absorbed recovery costs before Kaseya received the key on July 21 and worked with Emsisoft to release a decryptor the next day; Bitdefender later published a broader tool for some earlier REvil victims. The campaign-specific key was subsequently leaked on a hacking forum and verified by researchers, reinforcing that it worked for the Kaseya incident but was not a master key for all REvil infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
On July 22, 2021, Kaseya obtained a universal decryption key or decryptor for the attack from a mysterious trusted third party and began distributing it to affected customers. Reporting said customers were required to sign a non-disclosure agreement before receiving it.
On July 21, 2021, the FBI provided Kaseya with a digital decryption key it had obtained through access to REvil servers. The bureau had withheld the key for about 19 days while considering a broader operation against the ransomware gang.
As news of the attack broke on July 3, 2021, Kaseya urged VSA users to shut down their servers to prevent compromise. Around the same time, Kaseya said fewer than 40 customers were directly affected, though downstream impact was believed to be much larger.
On July 2, 2021, REvil exploited a zero-day vulnerability in Kaseya VSA to distribute ransomware through managed service providers and their downstream customers. The attack affected dozens of direct Kaseya customers and ultimately hundreds to roughly 1,500 businesses.
REvil's platform, including its Tor payment sites and infrastructure, went offline in mid-July 2021 without U.S. government intervention. The outage disrupted victims' ability to pay and derailed a planned U.S. disruption operation against the gang.
In June 2021, REvil attacked JBS, temporarily disrupting some operations in Australia, Canada, and the United States. The incident was cited as part of REvil's broader activity before the Kaseya attack.
After disappearing, REvil reappeared, rebuilt its platform, and resumed activity. By the time of the report, at least eight new victims had been logged.
Bitdefender later released a universal decryptor for systems encrypted by REvil before July 13, the date REvil's platform went offline. The company said it received the key from a law enforcement partner that was not the FBI.
Researchers including BleepingComputer, Emsisoft, and Flashpoint confirmed the leaked key successfully decrypted files from the Kaseya-related REvil campaign but did not work on other REvil samples. This established that the leak was campaign-specific rather than a universal master key for all REvil victims.
A post on a hacking forum linked to a GitHub-hosted screenshot showing a base64-encoded REvil decryptor key, giving researchers their first direct view of the Kaseya campaign's universal key. Flashpoint and others investigated whether the posted key could decrypt Kaseya-related REvil victims.
The day after receiving the key, Kaseya worked with Emsisoft to create and release a decryptor for affected victims. Emsisoft said it extracted the key, built the tool, and tested it within minutes.
Following the Kaseya-related disruption, Swedish grocery chain Coop closed about 700 stores for six days. Analysts estimated the shutdown likely cost the company millions of dollars in lost business.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
washingtonpost.com
Open sourcembsd.jp
Open sourcebleepingcomputer.com
Open sourcembsd.jp
Open sourceflashpoint-intel.com
Open sourcesplunk.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil affiliates exploited four zero-day flaws in on-premises **Kaseya VSA** servers to turn a trusted remote management platform into a ransomware delivery channel for managed service providers and their customers. The attack chain reportedly included an authentication bypass, unrestricted file upload, CSRF bypass, and command injection, allowing attackers to upload malicious ASP code and push ransomware through VSA with administrator-level access. Researchers said the campaign abused Kaseya-mandated antivirus exclusions, used `agentmon.exe` to launch malicious commands, decoded payloads with a renamed `certutil`, and side-loaded a malicious DLL through a signed dropper and an outdated Microsoft Defender binary while disabling multiple Defender protections. The supply-chain attack encrypted local, removable, and mapped network drives across downstream environments, affecting about **60 MSPs** and roughly **1,500 businesses**, though REvil claimed a far larger device count and demanded **$70 million** for a universal decryptor. Red Canary said it detected the activity before the vulnerabilities were publicly known by spotting behavioral indicators such as Defender tampering and registry changes tied to REvil, then used containment actions including endpoint isolation and hash banning across multiple customer environments. Kaseya later patched the flaws in version `9.5.7a` and subsequently obtained a universal decryptor from a trusted third party, which it distributed to victims as the FBI and DOJ continued investigating the incident.
Aug 15, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026
Attackers exploited a code injection flaw in on-premises **Kaseya VSA** servers to distribute a malicious update through managed service providers, turning the remote management platform into a supply-chain delivery mechanism for **REvil/Sodinokibi** ransomware. Kaseya said victims numbered in the low thousands, while tens of thousands of customers reportedly shut down VSA servers as a precaution; reporting cited especially heavy impact in the UK, South Africa, and Canada. The intrusion chain used an encrypted file named `agent.crt`, pushed as a **"Kaseya VSA Agent Hot-fix"**, then decoded it to `agent.exe` and launched the ransomware payload `mpsvc.dll` via DLL sideloading. The malware sequence also attempted to disable **Microsoft Defender** protections before encryption, underscoring the importance of controls such as Defender tamper protection to prevent unauthorized security-setting changes. Response guidance included shutting down on-premises VSA servers, disabling VSA agents, backing up sensitive data, rotating credentials including **`krbtgt`**, and investigating for persistence, data theft, and lateral movement. Published indicators included file hashes, registry artifacts, log locations, and source IP addresses associated with `curl/7.69.1` activity to help defenders scope exposure and hunt for compromise.
Jul 22, 2026