Priya Nair — Digital Forensics Analyst
Key Takeaways
- The attack leveraged CVE-2021-30116 for initial access into Kaseya VSA servers.
- Once established, the actors deployed a custom ransomware payload hidden within legitimate processes.
- Command and Control communications used encrypted channels to evade detection, coupled with frequent IP address changes.
Executive Summary
The Kaseya VSA incident marked a significant escalation in ransomware operations recently. Our investigation into the attack revealed sophisticated techniques that enabled the threat actors to infiltrate systems, deploy ransomware, and ultimately demand ransoms from numerous organizations. By utilizing a carefully crafted attack chain, the actors demonstrated a deep understanding of their target’s architecture. This detailed analysis outlines the entire attack lifecycle from initial access through to the impact and suggests areas of focus for SOC teams.
Initial Access
During our analysis, we observed that the attackers gained initial access through the exploitation of a known vulnerability, specifically CVE-2021-30116. This vulnerability, which affects the Kaseya VSA software, allowed actors to send specially crafted requests to the server, enabling remote code execution. By meticulously crafting these requests, the attackers could bypass authentication and gain control over the VSA platform. Subsequent reconnaissance revealed that at least 1500 organizations using this platform were at risk, leaving them vulnerable to subsequent stages of the attack.
Execution & Persistence
Once inside the environment, the attackers deployed a custom ransomware payload named REvil, known for its aggressive encryption capabilities. We discovered the payload was invoked through a dropped batch script located at C:\Program Files\Kaseya\Agent\agent.exe. This script not only executed the payload but also configured the application to run at system startup, providing persistence. Changes made to the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ensured that the ransomware would persist across reboots.
Command and Control
Our analysis of the malware’s C2 infrastructure revealed that the actors employed a multi-faceted approach to evade detection. They used various dynamic DNS services to obscure their command and control IP addresses, changing them frequently to make tracing more difficult. The C2 communication typically happened over SSL-encrypted channels on port 443, camouflaging the activities as legitimate HTTPS traffic. This enabled the malware to stealthily retrieve additional payloads and instructions from the attackers with minimal risk of detection.
Lateral Movement & Discovery
In the discovered samples, we noted that the ransomware utilized T1071.001 – Application Layer Protocol: Web Protocols for lateral movement. The implant would scan the network for additional VSA instances, attempting to access them using stolen credentials harvested during the initial intrusion phase. We identified instances where the actors executed net use commands on remote machines to map network drives, which indicates a systematic approach towards discovering and encrypting as many systems as possible.
Impact & Objectives
The direct impact of the attack was substantial, affecting hundreds of organizations worldwide. The ransomware successfully encrypted important business data, rendering it inaccessible and prompting organizations to consider paying ransoms due to the urgency created around the recovery of critical services. This led to significant operational disruptions and loss of revenue for affected organizations, as well as a tarnished reputation within their respective industries. The objective of the threat actors was clearly financial gain through extortion.
MITRE ATT&CK Mapping
- T1203 – Exploitation for Client Execution: Exploiting vulnerabilities in Kaseya VSA to achieve initial access.
- T1059.003 – Windows Command Shell: Use of script files to execute commands remotely.
- T1046 – Network Service Scanning: Discovery of VSA instances on the network for lateral movement.
Detection Opportunities
- Monitor for signs of CVE-2021-30116 exploitation attempts against Kaseya VSA instances.
- Implement network traffic analysis to identify unusual outbound connections, especially over port 443, indicative of C2 communication.
- Deploy endpoint detection and response (EDR) solutions that can identify and respond to the execution of known ransomware behaviors.
Analyst Notes
Given the sophisticated nature of this ransomware attack, it’s imperative that organizations fortify their defenses against such potential threats. Regular patching of systems, alongside updated intrusion detection systems, can mitigate the risk of exploitation. Additionally, training employees on recognizing phishing attempts and other social engineering tactics will enhance organizational resilience against attacks that might lead to unauthorized access in the first place.
Source: Original Report