The July 2021 Kaseya VSA attack hit managed service providers and, through them, their customers. CISA and FBI guidance from that week gives a checklist you can still use. If you run remote management tools or buy from an MSP, these eight questions show where you would have struggled.
What happened, in brief?
CISA and the FBI described a supply chain ransomware attack that exploited a vulnerability in Kaseya VSA software and affected multiple MSPs and their customers. Resource links in the guidance describe the attack as involving REvil. The guidance was published on 4 July 2021 and last revised on 6 July. The agencies noted that the indicator lists they linked had not been validated.
Kaseya's own notice, cited in the guidance, is dated 3 July 2021. The attacker's claims about the number of victims were not independently verified in the sources we reviewed, so we do not repeat them.
What did the agencies tell people to do?
For MSPs: run the Kaseya VSA Detection Tool on VSA servers and managed endpoints, enable and enforce MFA on every account the organization controls, allowlist remote monitoring and management traffic to known IP address pairs, and place RMM administrative interfaces behind a VPN or firewall on a dedicated administrative network.
For customers: keep backups current and air gapped, return to manual patching that follows vendor guidance, and use MFA and least privilege for admin accounts on key resources.
What are the eight questions?
If you are the MSP or run your own RMM
- Is the management console reachable from the internet? If it must be, what sits in front of it?
- Is MFA enforced for every account, including service and break glass accounts?
- Is RMM traffic restricted to known addresses?
- Can you take your own management platform offline quickly and still support customers?
If you buy from an MSP
- Do you know what tools your MSP uses to manage your systems, and with what privilege?
- Could you operate for a week if their management service went down? Who patches in that time?
- Are your backups air gapped from the network the MSP manages, and have you tested a restore?
- Does your contract say how and how fast the MSP must tell you about an incident?
How do you answer them?
Run the questions as a short tabletop. Ask the owner of each system to answer from evidence, such as a firewall rule or a console setting, not memory. Anything answered "I assume" goes on the list.
Where software is concerned, an inventory of the management tools that run with high privilege on your endpoints is the first thing to build. A software bill of materials for your own tooling, and for what vendors supply, helps you see which products sit in a position of broad trust.
Where do people go wrong?
Treating an MSP as outside the threat model is common. So is assuming backups work because jobs report success. A third trap is leaving legacy admin accounts without MFA because they are used rarely.
What to do
- List every remote management and monitoring tool in your environment.
- Put admin interfaces behind a VPN or firewall and restrict allowed addresses.
- Enforce MFA on all accounts that can log in to those tools.
- Write down your MSP's access and the contract terms on incident notice.
- Store backups offline and run a restore test each quarter.
- Draft a manual patch procedure for when central tools are down.
- Run the eight question tabletop twice a year.
Quick check
Was this a flaw in customers' own systems?
According to the CISA and FBI guidance, the attack exploited a vulnerability in Kaseya VSA software. Customers were affected through their MSPs.
What is the single most useful control?
There is no single one. Isolating management interfaces, enforcing MFA and keeping tested offline backups work together.
Sources
Last reviewed: 18 October 2026.
