Software
software:kaseya_vsa
Also: Kaseya software
Kaseya administration software used by managed service providers to administer customer networks.
Kaseya administration software used by managed service providers to administer customer networks.
“Kaseya VSA is their software”
“companies on the landscape. Instead of going for just small companies and going for the small game, just trying to get like $5,000 or $10,000, they want to go for the biggest company they can and unlock all their systems and try and steal millions from them, try and extort them, fall back for their files that are locked for as much money as they can. JACK: Mm-hm, I get it. So, if I got hit with ransomware or you got hit with ransomware on our home computer and that hard drive was encrypted and locked, whoever did it might only charge us a few hundred dollars to unlock it, ‘cause it’s just one person. This could scale up if you infect thousands of people’s home computers at once, and that does add up for criminals. But it sounds like this GandCrab group wasn’t trying to hit regular people like you or me. They were focused on infecting big companies or companies that had a lot of money at least, because those companies might just pay a million bucks to get their machine unlocked. [MUSIC] But there’s a bit of a problem with this whole plan; security. Infosec teams everywhere know about ransomware, and they put methods in place to stop their company from getting hit with it. So, even though GandCrab was great at encrypting machines, it still needed that initial access into the network. So, how does a criminal get access into a big company’s network? Well, they buy their way in. WILL: So, there’s a whole ecosystem of – that ransomware works with called initial access brokers, and there’s entire underground markets that you can buy access into certain companies. JACK: Yeah, I actually know about this. I’ve seen underground forums where people are selling access into companies. In fact, I interviewed a guy who did sell a login to his ex-employer’s network. That’s Episode 108, called Mark. He was a disgruntled ex-employee, but there are also people who are out there just playing around, trying to find a way into a company. Maybe they’re just curious or like the challenge, but they poke and prod until they find a way in. But they have no idea what to do once they get in, so that’s where they see others are selling access into networks on forums and decide to just sell their access. It’s a weird and strange market. So, this is how the GandCrab group would infect companies; they’d buy access into a company, then put ransomware on all those systems, and ask for a huge payment to unlock all those systems. But how much do you demand, and what companies should you hit? Well, to figure that out, GandCrab did some OSINT. WILL: [MUSIC] I mean, this thing’s like – there’s a website called ZoomInfo, I think. I’ve seen them on the underground forums literally mentioning linking to the websites; here’s how much they have in daily – in yearly profit and turnover. JACK: Oh man, what a mess, huh? Publicly-traded companies have to disclose their profits to shareholders so they can see what’s going on. But of course, criminals are taking a look at that too, and they’re like oh, this company had a stellar year. That’s a nice juicy target. Anyway, so this is what GandCrab focused on, companies with lots of money that they could get into. They’d get in, encrypt the systems, and demand ransom to unlock everything. And guess what? Companies were paying this ransom hand over fist. WILL: Yeah, if you can believe these criminals, they claim they earned $2 billion, roughly two-and-a-half million a week. JACK: I, for one, don’t believe that number at all. I mean, they posted these numbers themselves, and I think they just posted big numbers to look like they were doing great. I’m guessing it’s more like $2 million that they made, not $2 billion. But that’s still amazing profits, though. Now, GandCrab wasn’t just ransomware, but it evolved into ransomware as a service. If you wanted, you could pay to use this ransomware to infect a company, but you’d have to first get access into that company in order to deploy GandCrab into it and infect it. But then the GandCrab team would handle it all from there, working with victims to collect money and supply a decryption key. Then you’d get paid if the victim paid up. Some of these people who used GandCrab as a service got arrested in different places in the world because as you could imagine, extorting people and companies is illegal. But as GandCrab grew, they needed to recruit more people to their team. WILL: On the forums that they recruited cust – where they got customers from, they all speak Russian. These are all Russian-speaking threat actors. There’s a number of countries that speak Russian, but there’s only so many countries that allow cyber-criminals to operate with almost impunity except a very small margin – marginal amount, and that’s Russia. JACK: Okay, so yeah, there’s not much you can do to stop cyber-criminals operating out of Russia. The US has no jurisdiction or way to work with Russian to arrest these people, and Russia doesn’t seem to care too much if it’s not attacking Russian companies. So, it seemed like GandCrab was living large. It had all the people, malware, victims, and customers all set up, and the cash flow was pouring in, and no trouble from the police. [MUSIC] But then it all suddenly stopped. GandCrab posted on a forum saying they’re retiring. You know what? I get it; it makes sense. They earned $2 billion. I’d retire, too. But they didn’t retire. They spent time retooling, innovating, and improving their ransomware as a service business. They created a new ransomware malware. This time they called it REvil, and victims started seeing what this could do firsthand. WILL: So, REvil first appeared in April 2019, and it sort of began with – in the first zero to two months, it did the things that most ransomware does, which deletes backups, changes the wallpaper, does – they actually do a language check, so before a ransomware is executed, it will check the language that your computer is set to, and if it’s set to a list of countries that are members of the – what you call the Commonwealth of Independent States, the CIS – so if it’s a member of the CIS, then the ransomware will not execute and it will just exit. So, whoever is behind REvil doesn’t want to target countries that are basically ex-Soviet Union. JACK: So, REvil came on the scene, which again is the name of both the ransomware and the group operating it. WILL: I call them REvil because they – I’m pretty sure that’s what they called themselves. It’s based on Resident Evil. They called themselves R Ransomware Evil, short for REvil. I mean, GandCrab, there was about five versions of it. So, it was sort of like an experiment until they came out with REvil, which was basically the crown prince of ransomware. [MUSIC] It was so perfectly developed for what it was designed to do. It just sort of – every – all their entire work had sort of – this was like their magnum opus of ransomware. JACK: But here’s the thing; the group behind REvil saw how much money GandCrab made as a service that they realized that’s what they should focus on. Offering ransomware as a service was more profitable than putting ransomware on systems themselves. The idea here is that other criminals in the world would get access into the networks, and then they could use REvil to infect that network with ransomware. Then REvil does the rest; collecting payments, decrypting systems, helping victims get themselves sorted, and then they’d split the ransom with whoever deployed it on that company. So, criminals all over were using REvil to infect systems with ransomware, and they called their customers affiliates. WILL: It would all start with the affiliate wanting to launch an attack. They can either do it by going to REvil first and becoming an affiliate and have a plan to use their malware, or the affiliate can launch an attack and then go and physically buy access to one of these – this – these ransomware platforms and then deploy it. So, it’s different stages of when REvil would be introduced. It would start with the OSINT, it would start with picking a target, it would start with going to the underground forums looking for a way in, because you can buy RDP credentials. You can buy cookies. You can buy just e-mail account credentials and then start from there, or you can do that sort of initial exploitation yourself. One of the most common ways that REvil used to arrive inside the network was via exploiting a vulnerability in a public-facing server. So, once the vulnerability had been exploited, they would deploy a web shell or some – launch some power shell codes on the server, establish that initial foothold, and then do some reconnaissance inside the network and then spread around as best they can, and as well as escalate privileges. [MUSIC] Then once they are spread around enough and they’ve escalated their privileges to domain administrator level, then they will introduce the ransomware. One of the most – the common way they deploy it is via scheduling a task on all the computers in the network via using the domain administrator credentials. So, then everything is rebooted and you have about – you could have thousands of machines at any one time. I believe – I think it was one – a telecom company in South America had 15,000 workstations locked up overnight, and each one had the – had an – a blue background saying, ‘You have been attacked by REvil. Open for – open the note for instructions on how to pay the ransom.’ JACK: Early on when REvil was first coming up, Will got to see the impact of them firsthand. He was traveling out of London and had to go through the Heathrow Airport to fly somewhere. WILL: In Heathrow you have these currency exchanges run by a company called Travelex. When I went into the currency exchange, I saw everything was extremely hectic. People were shouting, it was an extremely long queue, and I was like, what the hell’s going on? Then I realized; I was like oh, I remember reading a report not too long ago that Travelex had been hit by REvil ransomware. I took a pic – I basically took a picture on my phone ‘cause I could see all the employees were using pens and paper and clipboards and things because none of the computers worked. Everything was down for weeks. This was about three weeks after the attack had happened, and Travelex reportedly paid a $2.3 million ransom, I believe. JACK: [MUSIC] Whoa, what a payday. I mean, you can put ransomware on a lot of systems, but if nobody ever pays to get their stuff unlocked, then it’s all for nothing. But when someone pays $2.3 million to have their computers unlocked, then that’s the fuel that makes REvil ransomware crew keep going. Some people think this whole ransomware thing can just all go away if we all agree to never pay the ransom ever again. But the truth is, companies are still paying in a big way, which incentivizes ransomware crews to keep at it, and there’s no guarantee these companies won’t get re-infected the next day and have to pay it all again. Clearly, the best idea if you get infected is to have good backups that you can restore rapidly. But REvil knew this, so they purposely looked for how systems got backed up, and then they went and wiped those backup servers first. This is probably why it was so effective. If the company had their backups wiped out and no path of rebuilding, it’s a lot cheaper to pay a few million dollars to get things back up and running. I mean, three weeks of being down could cost the company over $2 million in losses anyway. Surely it’s a tough spot for any company to be in. After a while, researchers started to notice a guy named Unknown who kept making posts on the forum claiming to be part of REvil. WILL: So, he used to post to two Russian-speaking underground forums. One of them was called Exploit and another one was called XSS. So, kind of typical names for hacker forums, but these two forums have been going for like, about fifteen years and they’re basically the two most popular hacking forums for Russian – like, hardened Russian cyber-criminals. [MUSIC] He was basically saying – boasting how REvil was the best ransomware. So, it was competing with several other strains at the time, including Maze and Ragnar Locker, I think, as well. He basically became the frontman of the whole operation. Everyone – it was like his net – his alias was basically synonymous with REvil, and yes, he went on to do interviews with several people online. They’d interview him, say how did you decide to get into the business of ransomware, or how much money have you made – make doing ransomware? Those sort of questions. Yeah, it sort of – it just makes it sound like it’s a huge – it’s a big order – it’s basically a big organization of cyber-criminals. I would probably say there’s anywhere between ten and twenty individuals actually connected to the running of the REvil core business, the core ransomware as a service business. JACK: Another thing this Unknown guy was saying was how REvil was doing more to extort people than just demanding ransom. WILL: They would then step it up a notch by leaking – stealing data and then leaking it with – to a Tor website. Because it’s on Tor, you can’t get it taken down. It’s like a wall of shame. That’s what they call it. It’s there forever. Then you know, a few months later, they’d add another level of extortion. So, that’s what we – they used to call double extortion, was encrypting your files and then leaking your data. They had a third level; they would now begin to DDoS you or your partners, and they would DDoS your websites until you actually began negotiations with them. JACK: Whoa, wait? What? They’re DDossing you, too? This is where they flood your website or service with so much traffic that your website is just completely unusable. It’s a low blow to hit you while you’re down. WILL: If you still haven’t entered the chat with them – because in the ransom notes they have a link to the chat – if you haven’t entered the chat with them to negotiate paying the ransom or anything like that, they basically believe oh, you’re able to recover. Like, no – if you’re a big company, like international company, then you will basically have backups, you’ll be able to restore files, you’ll be able to basically carry on after a few weeks of recovery, rebuild the network, whatever. So, REvil didn’t like that, when companies can recover on their own, so they will DDoS your website. If you have – say if you’re – you have a – you’re a retail company; you have customers coming to your website. Every hour is money, so if they’re DDossing you, taking it down, they’re still costing you more and more money. JACK: Okay, up until this point I’ve been referring to REvil as a ransomware group, but at this point, this is mean. This is more like street gang behavior, going around hurting people and robbing them without any remorse. So, I’m gonna now start referring to them as the REvil cyber-gang, because these guys were ruthless. Here, let me play something for you. This is a voicemail that a ransomware gang member left on an employee’s phone, a victim’s phone. It’s not from the REvil cyber-gang; it’s a different one called SunCrypt, but I think it’s worth playing here just to give you an idea how cold-blooded these guys can be. SUNCRYPT: This message is to authorized IT specialist or to company management representative. We are SunCrypt group. We hacked your company yesterday and now we have around 80 gigabytes of your company data encrypted to new servers as well as downloaded to our servers. We have personal information, partner data, financial and accounting data of your company, and much more. You need to start negotiations with us about decrypting your IT servers and bringing your company data back. Negotiate with us and you will get a decrypter, together with all your data back, within one day. No one in the world will know about this leak, but in case of your refusal to cooperate, we will run a great damage to your business. You will lose ten times more in courts due to violation of the laws on GDPR and your partner’s data leak. We will inform your employees, partners, government, about this leak. Your data will be published in public blogs and told to competitors. We will inform media about this successful cyber-attack to your company, and backdoor access to your company data will be sold to other hacker groups, and this will be the last day of your business. We don’t want to do that for sure, and we will not do that if you will negotiate successfully. So, we are waiting for you in the chat. Think about your future and your families. Thank you. Bye. JACK: Think about your future and your families? Whew, that’s so ominous. I mean, what would you do with a threat like that? Now, sometimes the REvil cyber-gang would just go infect targets themselves, and if they did, they’d get to keep 100% of the ransom they make from that. But in most cases, they worked with their customers or affiliates to infect the targets for them. WILL: So, it is known that they would – they basically split the ransom with the affiliate. They’d say, if you hit a company and you’re able to get them to basically agree to pay a $10 million-ransom, it’s – we’ll keep $60 million, you’ll get $40 million. Like a 60/40 or a 70/30 split, because they’re – at the end of the day, REvil, the RaaS, the ransomware as a service, would provide not only the malware but also the decryption, functionality, which was one of the – is one of the best, most complex decryption systems of any of the ransomware families at the moment, even. Then they would – they add all the infrastructure for darknet chats, darknet payment sites, money laundering. They fried a lot of back ends. So, it’s a worthwhile split for both parties. JACK: So, it was on the affiliate to figure out a way into the networks to deploy REvil as a service. WILL: So, I believe the affiliates are choosing the targets. They’re basically getting into these companies, doing the – they basically do the legwork, as I’d like to describe it. Like, somewhat – it’s a whole ecosystem. You have someone who gets an initial foothold in the network. They’re called the initial access broker. They will sell that – however small it is or big it is, they’ll sell that to someone else, the REvil affiliate. The REvil affiliate will spread around the network and escalate privileges and steal data. Then they will deploy REvil. JACK: [MUSIC] It’s just nasty, like all of it. For REvil to make it a turnkey solution so it’s easy for anyone to commit crimes with, and then people are just buying their way into these companies, sometimes through disgruntled ex-employees. Then REvil comes in and destroys backups and encrypts everything and then DDosses you and then taunts the victim until they pay; it’s awful. But we’re just getting started. You gotta hear what they do next and what happens at the end of all this. We’re gonna take a short break here, but stay with us. REvil continued to infect companies and make millions of dollars from these ransoms. I believe there are lots of companies that we’ll never know about that got hit with this, but there are some companies we do know that got hit with this, because it made the news. One of them was in 2019, and the victim was the Texas government. WILL: Yeah, so the Texas government one was interesting because it sort of started a trend that REvil liked to – it was – it ended up being deployed at what you call a managed service provider, which is an IT company that handles the IT of other organizations. So, the Texas government, they actually paid a single company to just manage the IT of all their institutions. Each institution doesn’t have to have an IT department then; it’s just one company that does it all for them. So, one of the REvil affiliates managed to get into the Texas government and deploy – I think it was twenty-two different governments that ended up being – entities ended up being attacked in this one instance. JACK: This one made the CBS news. HOST1: In Privacy Watch now, government computers in twenty-two Texas towns are being held hostage by ransomware. The state’s Department of Information Resources said that the coordinated attack happened on August 16, and many of the local governments still have not been able to get back online. JACK: [MUSIC] See, when so many government facilities have a computer outage all at the same time, it makes the news because it’s a noisy problem. It’s not something you can easily cover up quietly or make it go away quickly. Of course, REvil was saying hey, all these problems can go away if you pay us $2.3 million. But the Texas government did not enter the chat and did not pay a single cent. They recovered all on their own somehow. In May 2020, a company called GSM Law was the victim to this cyber-gang. Here’s CNBC news. HOST2: An entertainment law firm run by Allen Grubman confirming its computer systems were hacked. The hackers say they have sensitive information about several big-star clients, and those hackers want $42 million in ransom. JACK: [MUSIC] Whoa, $42 million? That’s the largest ransom payment ever demanded at the time. They must have stumbled upon something spicy in that network. WILL: So, some of GSM Law’s clients include Madonna, Elton John, Lady Gaga, and probably most famously, Donald Trump. It’s a big New York law firm, so Donald Trump, he’s lived in New York his whole life. So, REvil managed to get into GSM Law and steal – allegedly steal hundreds of gigabytes of data from them; 756 gigabytes, they claimed. They threatened to basically disclose Donald Trump’s solicitors’ information, like from his lawsuit. Everyone knows Donald Trump has like, thousands of lawsuits on the go. So, REvil was basically able to go through them all. JACK: Huh, that’s interesting. REvil is presumed to be operating out of Russia. I wonder if they had to stop for a moment and think about what to do with Trump’s legal documents. WILL: It became a whole thing. Everyone was saying oh, this is like cyber-terrorism or whatever. How can Russia allow this to happen? This is meddling with the presidency or whatever, ‘cause he was still president at the time. Yeah, it – basically REvil said – they had to come out and make a statement, like we are apolitical, we’re just financially-motivated criminals. We don’t want to cause any problems. They actually seemed to – I mean, it’s kind of a weird thing to say, but they actually seemed to like Donald Trump, I think ‘cause they were – they thought of themselves as these ultra-rich, super-smart cyber-criminal masterminds, and they sort of admired Donald Trump as he was really rich as well. JACK: [MUSIC] Hm, research into this is a little murky. REvil had released a little bit of what they stole to prove they had something from one of GSM Law’s clients, and then they said the next person we’re gonna dump records on will be Trump. One news agency looked into this and said Trump isn’t even a client of GSM Law. So, we think Trump probably wasn’t a client and just mentioned in some lawsuit. But you might wonder what happened next with GSM Law? Did they pay the ransom or what? Well, we don’t know. Nothing happened. We never saw REvil release any data on Trump or dump a bunch of legal documents, so that makes me think that either they never had the data, which they did lie sometimes, or GSM Law negotiated the ransom. I’m not exactly sure what happened with that. Now, ransomware at this point was looking like a very lucrative way for criminals to make money. If you think about it, suppose you hack into a company and you were a criminal and you wanted to profit off this access. What are your options? Okay, well, you could sell your access that you have, but I can’t imagine this making very much money; maybe a thousand bucks. You could try to install some cryptominers on there, but that’s such a slow process to make money from. You could try to look around for some database to steal and then maybe sell that database to someone, but that’s a tough market to be involved with. You could do a business e-mail compromise attack and try to figure out what’s going on in the finance department and see if you can get them to send you some money, or you could look around to see if there’s anything valuable in the company to steal, like money, right? In fact, there was another group at the time called FIN7, which focused on hacking into banks and stealing credit cards. Well, you would think that that’s a very good way to make money illicitly, and it is, but FIN7 was seeing how much easier it is to just put ransomware on a computer and just leave it at that, because there’s a lot of work to dealing with thousands of credit cards or trying to launder money and make it clean. But it’s so much easier to just wait for a single ransomware payment in Bitcoin and then move on. Since FIN7 was already pretty good at breaking into networks, this really turned them on to a whole new revenue stream. WILL: Yeah, so DarkSide was FIN7’s first ransomware project. They had tried out REvil for a few times. Their infrastructure had been connected to REvil attacks via pivoting on IP addresses and things from known attacks. FIN7 basically realized okay, every time we use an – every time we launch an attack using REvil, we have to give them a cut. Isn’t it just easier if we develop our own ransomware and then launch our own attacks? Then we don’t have to give a cut to anyone. We can keep it all for ourselves. So, after a time they realized okay, it’s actually – you make even more money if you begin ransomware as a service, because then you just rent out the ransomware to multiple groups and begin making money your own way. JACK: Wow. So, at that point, FIN7 had totally quit robbing banks and turned into a ransomware as a service business because of how profitable they saw REvil was. WILL: [MUSIC] Ransomware is the most valuable way to make money when you’re inside any network, anywhere in the world. JACK: FIN7 was one of the most profitable criminal groups out there, so it’s just crazy to hear how they switched from robbing banks to ransomware. But at this point they became competitors, and I’m not going to go into any more details about FIN7 or DarkSide in this episode, but rest assured, that’s a really interesting story all by itself, and I’ll have to cover that in an episode someday. Now, when REvil gets a ransomware payment, they typically receive it in Bitcoin, and then they’re actually pretty good at laundering that money by typically converting it into Monero, which is much more secure and I think untraceable, and then they’d be able to cash it out without it leading back to whoever is behind REvil. But I have to imagine how insane of a chat it must be when a company does want to pay a million-dollar ransom in Bitcoin. These ransomware negotiation chatrooms must be the wildest thing ever. WILL: I’ve heard from ransomware negotiators and incident response people that these ransomware teams have much better customer service than most companies do. They will guide you step-by-step the whole way on how to pay a ransom, how to get the cryptocurrency, how to store it, how to send it to them, all the checks, all the balances. JACK: I mean, can you imagine being the IT admin and all your computers are encrypted, and your management has given you the go-ahead to pay the ransom? So, you get on Tor and enter the ransomware negotiation chatroom. You might say okay, look, we’re willing to pay, but we don’t have any Bitcoin. Can we just wire you the money? REvil ransomware negotiators are like LOL, no, that’s traceable. You need to send us Bitcoin. Go to an exchange and buy some. [MUSIC] Here’s the problem; you can’t just show up to Coinbase or Gemini or Binance or whatever and be like uh, yeah, I’d like to buy $2 million in Bitcoin, please. No, they have daily limits set up. You can only buy a few thousand dollar’s worth at a time, so you call up customer support at an exchange and you tell them listen, I want to buy $2 million worth of Bitcoin. The exchange might be like whoa, that’s a lot of money. What’s that for? You’re like oh, it’s to pay a ransom. That’s a red flag for the exchange. I think by law, exchanges can’t sell you Bitcoin if they know you’re going to use it to pay a ransom with. So, it becomes a huge ordeal just to secure that much Bitcoin. WILL: You have to remember that when millions of dollars are involved here, like if a company, it says okay, yeah, we plan to pay $5 million in a ransom, they will hire a expert to help them with it. So, there are ransomware negotiation firms now that their whole job is to help companies get through when they’ve been hit by a ransomware attack. So, these negotiators know all the ways to pay a ransom, basically. They know – they even know – they keep track of all the wallets, they keep track of all the contact details of each ransomware group, so they know – sometimes if these negotiators respond to multiple incidents, they will be able to recognize the person on the other end of the ransomware negotiation portal. JACK: What? There’s a whole industry out there helping people negotiate and pay ransom? This is madness. I mean, think about it; imagine if you’re in the chat with REvil and you’re like, how do I do this? They’re like okay, well, you could just call this company and they’ll help you walk through it. It’s just so zany to think about this. I wonder, do these ransomware negotiators offer any sort of referral program? So, if REvil refers them and they hop on the chat and like oh, hey Dmitri, how’s it going? Thanks for referring me. I’ll make sure to get you that referral bonus. Or take it a step further; imagine REvil refers you to a quote, unquote “expert service” who’s just another criminal, and you give them $2 million to buy Bitcoin and they just take off with the money. WILL: Well, there are legitimate companies, but as you say, this could easily be taken advantage of and has been by companies that really do some really shady stuff. Like, say if a company gets hit by ransomware, sometimes they’ll come in and – the company will come in, like the response company will come in, and say yeah, yeah, we can deal with it all for you. How much did the ransomware gang tell you it was gonna cost? Oh, $4 million. Well, actually it’s gonna cost $5 million. Then they’ll pay the ransom, decrypt the files, clean the network, and then be like yep, here’s your – here’s your bill; $5 million. But you just used the decryption key. JACK: [MUSIC] If you turned on NBC News, on June 1, 2021, you would have saw this. HOST3: It’s another attack on critical infrastructure, this time the food supply. The world’s biggest meat producer, JBS, forced to curtail operations after a ransomware attack. At least six plants in the US shut down. Operations also affected in Australia and Canada. WILL: That was a huge international incident. Everyone said that was the one step too far. JACK: JBS is the largest meat supplier in the US. I think they produce over 20% of the meat for the US, with locations in Canada and Australia. Because it was so big, it was deemed critical infrastructure. If the food supply chain is unable to deliver food, well, that can be a really big problem. HOST4: The meat-packing firm JBS USA paid a ransomware equivalent to $11 million after it fell victim to a cyber-attack. The company’s US CEO said on Wednesday they made the payment to protect their customers. Last week’s cyber-attack led to the suspension of cattle slaughtering at all of JBS’s US plants for a day. The company produces nearly a quarter of America’s beef. JACK: $11 million paid up. That’s a lot of Bitcoin to send over to someone that you hope will fulfill their end of the deal and give you an encryption key. What a nail-biter that’s gotta be when you click Send and you’re just sitting there in chat, waiting for the criminal to give you a key. Whew. WILL: There was another company that was another, in quotes, “step too far”. They’ve done it now. They hit a company called Sol Oriens, which was a nuclear weapons contractor for the US. This is like, okay, now you’re affecting the nuclear triad or something like that, you know? How can this ransomware group get away with all of this? JACK: But still, we haven’t gotten to REvil’s biggest hits yet. Over this period of years, REvil was getting into hundreds of companies and putting ransomware on them. The ones who didn’t pay would get posted to their blog. WILL: Their leak site had 282 leaked companies’ data published to it. So, that’s how many companies didn’t pay, because they were leaked onto the leak site. Some of the stats coming out of Europol said that they had launched thousands of attacks. [MUSIC] Probably one of the smartest things REvil ever did was they went into a – what we’d call a cyber insurance company. So, because ransomware is such a huge thing, companies – like, when they get hit by a ransomware attack, it can cost them not only X-number of million dollars for the ransom, but to actually clean up the network and restore it or rebuild it could cost them hundreds of millions. So, they need insurance to be able to cover that cost for ransomware specifically. So, what REvil did was they went into an insurance company and they looked at all of the insurance company’s clients and they hit each target one by one, ‘cause they know how much they were gonna get paid out for from the insurance cost. Then they hit the insurer themselves as well, for good measure. JACK: Here’s a clip from CBS News that tells us about the next victim. HOST5: FBI investigating what may become one of the world’s largest ransomware attacks on companies – get back to work following the holiday weekend. A Russia-based cyber-criminal group called REvil is demanding a $70 million-ransom. Hackers hit IT software company, Kaseya, Friday. WILL: [MUSIC] Wow, where do I begin? The Kaseya, that was basically one of the biggest supply chain incidents since NotPetya. Kaseya are the manufacturers of a software called – Kaseya VSA is their software. Companies, like I mentioned before, managed service providers, will buy Kaseya VSA”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | AFFECTS | REvil | Explicit | 126 |
| incoming | INITIAL_ACCESS_VIA | Kaseya ransomware attack | Derived | 126 |
REvil AFFECTS Kaseya VSA
REvil exploited Kaseya VSA to reach managed service providers and their customers.
Explicit Confidence 99% · Will EP 126 Details
“by exploiting the Kaseya software to deploy REvil, they were able to hit 1,500 networks in one go overnight”
Kaseya ransomware attack INITIAL_ACCESS_VIA Kaseya VSA
REvil gained access to downstream networks through Kaseya VSA.
Derived Confidence 97% · Will EP 126 Details
“by going into the Kaseya software, REvil basically had a foothold into all of the MSP’s customers”