Possibly not in time, because the attack arrived through a trusted management tool. CISA and the FBI called the July 2021 Kaseya VSA event a supply chain ransomware attack that affected multiple managed service providers and their customers. What limits harm is control over remote management tools, offline backups and least privilege.
What happened?
Per the joint CISA and FBI alert, published 4 July 2021 and revised on 6 July, attackers exploited a vulnerability in Kaseya VSA software. The attack affected multiple managed service providers (MSPs) and, through them, their customers. The alert's linked resources refer to the group behind it as REvil.
A key detail for a checklist: the customers who were hit did not click on anything. A tool their provider used to manage their machines was the delivery route. Blame belongs with the attackers, and the lesson is about where trust is placed.
What did the agencies recommend?
For MSPs: run the Kaseya VSA Detection Tool on VSA servers and managed endpoints; enable and enforce multifactor authentication on all accounts; allowlist communication to remote monitoring and management (RMM) tools so only known address pairs can connect; and place RMM administrative interfaces behind a VPN or firewall on a dedicated administrative network.
For MSP customers: keep backups current and offline, in a place that is easy to restore from; return to manual patch management that follows vendor guidance; enforce multifactor authentication; and apply least privilege to administrative accounts.
The agencies also said the indicator resources they linked had not yet been validated, since the guidance was shared quickly. That caution applies to any early incident intelligence.
Would you have caught it? Questions to ask
If you use an MSP or run your own RMM:
- Do you have a list of every remote management tool with access to your endpoints, and who operates each one?
- Is its administrative interface reachable from the internet?
- Does multifactor authentication cover every account that can push software to your machines?
- Can your provider push to every device at once, and can you stop that?
- Do you hold your own backups that your provider's tools cannot reach?
- Has anyone tested a restore in the last year?
- Does your contract require the provider to tell you quickly about a compromise?
What to do
- Inventory remote management and monitoring tools and name an owner for each.
- Ask each provider where its admin interface sits and who can reach it.
- Require multifactor authentication on every account with rights to deploy software.
- Keep an offline copy of your critical backups, outside your provider's access.
- Test one restore, with a timer.
- Add a clause to the contract: notification time for a compromise, and rights to review their controls.
- Scope administrative accounts to the least they need, per customer or site.
- Subscribe to government alerts for the products you rely on, and treat early indicators as unvalidated.
Where does software supply chain tooling help?
Safeguard focuses on the components inside software you build or buy, so it will not detect an attack on a provider's management console. It does help with the neighboring question: which third-party software and components are in your estate. Treat that as inventory input, and keep the controls above as the core defense.
Quick check
Was this a zero day?
The CISA alert describes an exploited vulnerability in Kaseya VSA software. Read the vendor and agency notices for the exact timeline.
What is the one control to start with?
Offline backups you have tested. They limit the cost of almost any ransomware event.
Sources
Last reviewed: 18 October 2026.
