In July 2021, attackers used a vulnerability in Kaseya's on-premises VSA remote management software to push REvil ransomware to managed service providers and their customers. Kaseya detected the incident on 2 July and told customers to shut servers down. The lesson for defenders: a remote management tool is a privileged supply chain link and needs strict access control.
This post uses CISA guidance, Talos analysis and a CSO Online timeline. Where sources disagree, we say so.
What happened, and when?
2 July 2021. Kaseya detected a potential incident in VSA and told on-premises customers to shut down their servers. Talos recorded the first command execution at 10:30 ET with the Kaseya Agentmon process as the parent, and a dropper ran about two hours later.
3 July. Kaseya confirmed it was the victim of a cyberattack and released a compromise detection tool for customers, according to CSO Online. (Talos dates the detection tool to 4 July, which is one example of the small date differences between sources.)
4 July. REvil claimed more than one million infected devices and offered a universal decryption key for 70 million dollars in Bitcoin. CISA and the FBI published guidance for affected MSPs and customers. The Dutch Institute for Vulnerability Disclosure said it had reported CVE-2021-30116 to Kaseya and was in coordinated disclosure when the attacks began.
5 July. Kaseya said fewer than 60 customers were compromised.
22 to 26 July. Kaseya said it obtained a universal decryptor from a third party, that Emsisoft confirmed it worked, and that it did not pay a ransom.
8 November. The US Justice Department announced the arrest in Poland of a Ukrainian national suspected in the attack and the seizure of more than 6 million dollars in ransom payments.
Where do sources disagree?
Scale. Kaseya's own early counts were 40 on-premises customers and then fewer than 60. CSO Online cites up to 2,000 organisations affected globally, which includes downstream customers of MSPs. Both can be true because the numbers count different things.
Initial access. Talos's first version said victims were infected through a malicious automatic update. Its 6 July update revised that and attributed initial compromise to exploitation of CVE-2021-30116 on VSA servers. Read the updated version.
Behaviour. Talos noted that this campaign departed from typical REvil behaviour: no observed data exfiltration or shadow copy deletion, and a campaign-wide decryption key was advertised.
What should defenders learn?
Treat remote management as crown jewels. CISA and the FBI told MSPs to run the Kaseya detection tool, enforce MFA on all accounts, and restrict access to remote management tools by IP allowlist or a VPN or dedicated administrative network.
Keep backups where attackers cannot reach. CISA told customers to keep current backups in an air-gapped location. Talos recommended tested offline backups and the 3-2-1 approach: three copies on two systems with one offline.
Plan for the tool being down. CISA advised customers whose remote management service was offline to move to manual patching that follows vendor guidance. If your only way to patch is the tool, write a fallback.
Shorten the gap between a disclosed bug and a patch. DIVD's disclosure was in progress when attacks began. A reported vulnerability in an internet-facing management console deserves faster handling than normal severity rules give it.
Know your suppliers' tools. Ask your MSP which management platform it uses, how it is hardened and what it will tell you in an incident.
What to do
- List every remote management and administration tool in your estate, including your suppliers'.
- Require MFA and network restriction on each, and remove internet exposure where you can.
- Check that one backup copy is offline and that you have tested restoring from it this year.
- Write a manual patching and recovery plan for the day a management tool is unavailable.
- Ask suppliers how fast they notify you and which contact they use.
- Subscribe to advisories for each management product you run.
Quick check
Which vulnerability was used against Kaseya VSA?
Talos and the Dutch Institute for Vulnerability Disclosure identify CVE-2021-30116 as the flaw exploited on VSA servers.
How many organisations were affected?
Sources differ. Kaseya reported fewer than 60 of its own customers compromised, while CSO Online cites up to 2,000 organisations globally including MSP customers.
Sources
- CSO Online: the Kaseya ransomware attack, a timeline
- Cisco Talos: REvil ransomware actors attack Kaseya
- CISA: Kaseya ransomware attack, guidance for affected MSPs and their customers
- CISA-FBI guidance for MSPs and their customers (4 July 2021)
Last reviewed: 18 October 2026.
