Geo-political tensions are high, and with more nation-state harbored advanced adversaries, it seems as if ransomware can only get worse from here until there is a major breakthrough in country leader conversations.
We sat down with Ryan Chapman, SANS Certified Instructor Candidate to discuss the Kaseya ransomware attack, what it means for the industry, and how companies and prepare themselves for this new wave of ransomware.
Why will identifying the origin of the attack be increasingly difficult? Identifying the origin of a ransomware attack can be easy or difficult, depending on your viewpoint. To begin, we know an affiliate of the REvil Gang perpetrated the attack. In most ransomware cases these days, the groups are brazen about announcing who they are. This is a boisterous game of "WE DID THIS!" rather than a silent, hiding in the shadows thing. In that regard, the matter of finger-pointing to the overall association involved is simple.
A more complicated matter is that of identifying the actual affiliate who carried out the attack. With the Kaseya attack, a key matter of importance is identifying the initial access broker (IAB). Ransomware attacks are carried out by various teams, each of whom plays a specific role in the attack. In this case, initial access was gained via the exploitation of a "0-day" vulnerability. The Kaseya case is an ongoing incident, and we as a threat intelligence community do not yet know what affiliates of REvil might be responsible for the attack. The possibility exists that events may unfold in certain forums involving one side or the other providing more information to the public. For that matter, ransomware operators and their affiliates have in the past disagreed to the point of instituting courtroom-like hearings. We won't know what to expect until more time has passed. How can Kaseya best navigate the aftermath of the attack?
The best way for Kaseya to navigate the aftermath of this attack is for them to be as transparent as possible. The firm is currently working around the clock, and their dedication to updates on the matter shows. Kaseya's CEO, Fred Voccola, recently addressed the Kaseya community on July 5 and 7, 2021.
While the company has been working hard to respond to the incident, the community at large still has questions that will need to be answered. An organization named DIVD CSIRT has stated that they notified Kaseya of multiple vulnerabilities earlier in April of this year. We in the community would absolutely love additional information from Kaseya on this - if the company had pre-knowledge of vulnerabilities leveraged in the attack, they might have been working on a fix. Patching is not an easy task, especially with a system as complicated as theirs.
Some people will scream, "they had 90 days!" while others recognize that timelines don't always play out so easily. We could also learn that the vulnerabilities disclosed to them in April weren’t even involved here, at which point bashing the company over current theories is just silly. What are the far-reaching implications of the attack and how it could be leveraged for future cybercriminal activity? This latest REvil ransomware attack involving Kaseya is not "new." Sure, the vulnerability exploited was new, but otherwise, things are reminiscent of what we've seen in the past. The overarching goal was simple: attack a vendor platform capable of granting access to additional targets (your MSPs, MSSPs, etc.).
While various implications loom, my fear is that this method of attacking those with visibility and access to numerous companies will increase. The attack vector isn't new, but it could become more enticing given the visibility this incident has in the public eye. I'm also worried about the $70MUSD price tag for a universal decryptor. That price may not sound legitimate at first. But for the companies who were hit with $5m/$10m ransoms, banding together to minimize individual company payment may eventually seem like a good idea. And that's what worries me; we could experience a greater push for companies to band together to support the enemy. Why is incorporating feedback from ransomware negotiators and cyber professionals prior to drafting legislation aimed at curbing ransomware so important? Any form of legislation dealing with ransomware could have a major impact on organizations and security professionals. To better understand those impacts, Congress should do their best to engage everyone who is involved with ransomware. The business, financial, reputation, personal, and other impacts of ransomware are different for everyone involved, and we need to recognize that when making broad policy decisions. Those involved can include victim organizations, incident responders, legal counsel, insurance companies, negotiators, and more, all of whom are be impacted differently by ransomware. Changing how they deal with an attack through legislation must take their experiences into account as not doing do could increase the impact of an attack rather than mitigate it. We also have to understand how threat actors might react to legislation like changing tactics that might make it more difficult to handle an attack. The true impact of any potential legislation can only be known once each and every one of the general roles involved has been probed for feedback.
###