Ransomware attack hits hundreds of US firms

US technology company Kaseya urged customers to shut down their servers on Friday after cyberattackers smuggled ransomware onto its network platform.

The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack, said John Hammond of the security firm Huntress Labs. He added that the criminals used Kaseya's network-management package as a conduit to spread the ransomware through cloud-service providers.

Huntress Labs said on Saturday that the software was manipulated "to encrypt more than 1,000 companies." 

Kaseya said Friday evening that it had limited the attack to a "very small percentage of our customers" who use its software, "currently estimated at fewer than 40 worldwide."

Ransomware attacks typically involve locking data in systems using encryption and making companies pay to regain access. Such attacks infiltrate widely used software and spread malware as it updates automatically.

Businesses scrambled Saturday to contain the ransomware attack. In Sweden, most of the grocery chain Coop's 800 stores were unable to open because their cash registers weren't working, Swedish broadcaster SVT reported.

Unclear how many customers affected

"We are in the process of investigating the root cause of the incident with an abundance of caution but we recommend that you immediately shut down your VSA server until you receive further notice from us," Kaseya said in a message shared in a Reddit forum. "It's critical that you do this immediately, because one of the first things the attacker does is shut off administrative access to the VSA."

It was not immediately clear how many Kaseya customers might be affected. A virtual systems administrator, or VSA, is the company's main offering, which allows companies to manage networks of computers and printers from a single point. The company's US headquarters are in Florida and its international headquarters are in Ireland.

The US Cybersecurity and Infrastructure Security Agency (CISA) said that it was "taking action to understand and address the recent supply-chain ransomware attack" against Kaseya VSA and the service providers using the software.

The agency urged businesses to follow Kaseya's guidance and quickly shut down VSA servers to avoid having systems compromised. Active since April 2019, REvil provides ransomware-as-a-service, meaning it develops network-paralyzing software and leases it to affiliates who infect targets and earn most of the ransoms.

The group is among ransomware gangs that steal data from targets before activating the ransomware.

The UN Security Council this week held its first formal public meeting on cybersecurity, addressing the growing threat of hacks to countries' key infrastructure. Multiple US companies, including the computer group SolarWinds, the Colonial oil pipeline and meat producer JBS have recently been targeted by ransomware attacks. The FBI has blamed those attacks on hackers based in Russian territory.

mvb, lc/rc (AP, AFP)