Kaseya and REvil: timeline and what defenders should learn

On 2 July 2021, the REvil ransomware group used a flaw in Kaseya's VSA remote management software to push ransomware to customers of managed service providers. Kaseya told on-premises customers to shut VSA down that day. The lesson is that a trusted management tool can deliver an attack as well as a patch.

What happened, in order?

The dates below come from CSO Online's timeline, checked against CISA and FBI guidance where noted.

• 2 July 2021. Kaseya detects a potential incident and tells on-premises customers to shut down their VSA servers. It also takes its SaaS servers offline as a precaution. Early indicators point to about 40 affected on-premises customers.
• 3 July. Kaseya confirms it was the victim of a cyberattack and releases a tool to detect compromise.
• 4 July. CISA and the FBI issue joint guidance. REvil claims more than one million infected devices and asks for $70 million for a universal decryptor.
• 5 July. Kaseya says fewer than 60 of its customers were compromised directly.
• 11 and 12 July. Kaseya releases the on-premises patch and restores SaaS. Sources differ slightly on the timing of the final SaaS restoration, so treat "11 to 12 July" as the safe wording.
• 13 July. REvil's websites go offline.
• 22 July. Kaseya says it obtained a universal decryption key from a third party, and on 26 July says it did not pay a ransom, directly or indirectly. One other source gives 21 July for the key, so the exact day varies by source.
• 8 November. The US Department of Justice announces charges against Ukrainian national Yaroslav Vasinskyi, arrested in Poland, and the seizure of more than $6 million in ransom payments.

How many victims were there?

Counts vary and are estimates. Kaseya's own number for direct customers was under 60. The downstream spread, since each affected service provider managed many businesses, is estimated by CSO at up to 2,000 organisations worldwide. Do not treat any single figure as exact.

What did CISA and the FBI tell people to do?

The joint guidance, last revised 6 July 2021, said this for affected MSPs: run the Kaseya VSA Detection Tool on VSA servers and managed endpoints, enable and enforce multi-factor authentication on all accounts, and limit RMM communication to known IP address pairs or place RMM admin interfaces behind a VPN or firewall on a dedicated administrative network.

For customers: keep current backups in an easily retrievable location that is air-gapped from the network, return to manual patching following vendor guidance, and use MFA and least privilege on admin accounts for key network resources.

What should defenders take from it?

Management tools are high value targets. An RMM agent runs with deep access on every endpoint it manages. If you run one, treat its server like a domain controller.

Isolate the admin plane. The guidance to put RMM interfaces behind a VPN or firewall on a separate network is cheap and specific.

Backups only help if they survive. The air-gapped recommendation exists because ransomware that reaches your backup store ends the argument.

Know your supplier's incident channel. Kaseya's notices were the authoritative source in the first days. Subscribe to those feeds before you need them, and name who watches them.

Keep a manual fallback. Customers whose RMM was down were told to patch manually. Rehearse that once.

What to do

1. List every remote management and update tool with privileged reach, and who administers each.
2. Put admin interfaces behind a VPN or an allow list, and require MFA.
3. Test that an offline copy of your backups restores.
4. Record each supplier's security notice channel and assign a watcher.
5. Add the CVE and vendor advisories for your management tools to your vulnerability triage, flagging known exploited entries first.
6. Write a short manual patching procedure for when central tooling is off.

Quick check

Sources

• CSO Online, the Kaseya ransomware attack: a timeline, fetched 18 October 2026
• CISA and FBI guidance for MSPs and customers affected by the Kaseya VSA attack, fetched 18 October 2026

Last reviewed: 18 October 2026.