Most small businesses don't run their own IT. A managed service provider (MSP) does it for them: patches, backups, new laptops, the help desk. To do that from one office for hundreds of clients, the MSP puts a remote monitoring and management (RMM) agent on every PC and server. The agent runs as the most powerful account on the machine and does whatever the MSP's central server tells it to.
On Friday 2 July 2021, just before the US Independence Day weekend, the REvil ransomware group took control of that central server at dozens of MSPs that used Kaseya VSA on their own premises, and told every agent to run ransomware. Kaseya counted about 60 direct customers hit and 800 to 1,500 businesses downstream. In Sweden the Coop grocery chain closed about 800 stores because its tills were managed through an affected provider. REvil asked $70 million for a single key to unlock everyone.
Step 1: the flaws were already known
In April 2021 researchers from the Dutch Institute for Vulnerability Disclosure (DIVD) reported seven vulnerabilities in VSA to Kaseya, including CVE-2021-30116, a credentials leak and business logic flaw in the web interface. Kaseya had fixed four by early July and had patched 30116 in its cloud (SaaS) version, but the on-premises fix wasn't shipped yet. DIVD was scanning for exposed VSA servers and warning their owners when the attack began. The patch that finally closed the holes, VSA 9.5.7a on 11 July, fixed CVE-2021-30116 (credentials leak and business logic), CVE-2021-30119 (cross-site scripting) and CVE-2021-30120 (a two-factor authentication bypass).
Step 2: into the VSA server, no password needed
Huntress, which helped several hit MSPs, reconstructed the entry: an authentication bypass in the VSA web interface gave the attackers a session, then they uploaded two files (agent.crt and Screenshot.jpg, recorded in the server's KUpload.log) and used SQL injection to run their own code on the server. No MSP employee's password was phished. The servers were simply on the internet with a known, unfixed hole.
Step 3: a procedure called "Kaseya VSA Agent Hot-fix"
VSA lets an administrator write an agent procedure (a script) and schedule it on any or all managed machines. That is the product's whole purpose. The attackers created one named "Kaseya VSA Agent Hot-fix" and pushed it to every agent around 11:00 US Eastern time. A second procedure, "Archive and Purge Logs", cleaned up after them on the server.
On each PC, running as SYSTEM, the procedure:
1. Switched off Microsoft Defender's protections with PowerShell Set-MpPreference: real-time monitoring, script scanning, network protection, controlled folder access, cloud reporting.
2. Copied Windows' own certutil.exe to cert.exe and used it to decode agent.crt into agent.exe in the agent's working folder, C:\kworking.
3. Ran agent.exe, which was signed with a valid code-signing certificate and dropped two files into C:\Windows: an old, genuinely Microsoft-signed copy of Defender's MsMpEng.exe, and a malicious mpsvc.dll next to it.
4. Side-loaded the ransomware: the real Defender program loaded the fake DLL, so the encryption ran inside a trusted Microsoft process.
5. Waited for a common start time (16:30 UTC per Huntress), so machines at every MSP encrypted together.
Step 4: the response
• 2 July, afternoon: Kaseya told every on-premises customer to shut down their VSA servers immediately and took its own SaaS service offline as a precaution.
• 4 July: Kaseya released a detection tool; Huntress said nearly 900 customers asked for it within days.
• 11 July: VSA 9.5.7a, the on-premises patch, shipped, and the SaaS service came back over the following days.
• 13 July: REvil's sites went offline.
• 21 July: Kaseya obtained a universal decryptor. The Washington Post later reported the FBI had held the key for 19 days while it planned an operation against REvil, a decision the FBI Director defended before the Senate.
• May 2024: a US court sentenced Yaroslav Vasinskyi, the REvil affiliate behind the attack, to 13 years and 7 months in prison and $16 million in restitution.
Why the agent was the perfect delivery system
• It already runs as SYSTEM on every machine. No privilege escalation needed.
• It is trusted by design. Antivirus is often told to ignore the agent's working folder so the MSP's own tools aren't blocked, and that folder is exactly where agent.exe was written.
• It reaches everyone at once. One server, one procedure, thousands of PCs across hundreds of unrelated companies.
• It works over the weekend. Nobody at the client is watching, and the MSP's own staff were being encrypted too.
• The client can't see it. Most small firms don't know which RMM tool their provider uses, where its server runs, or who can log in to it.
What a small firm should ask its IT provider
You can't patch your MSP's server. You can ask questions, in writing, and pick the provider whose answers are specific.
1. Which remote-management tool is on our machines, and where does its server run? Their own server on the internet, or the vendor's cloud? If self-hosted: who patches it, and how fast after a critical advisory?
2. How do your staff sign in to it? MFA for every technician, ideally phishing-resistant (security keys or passkeys), and access only from the MSP's own network or VPN.
3. Can one technician push a script to all clients at once? Ask for limits: per-client approval, a second person for scripts that go to everything, alerts on new procedures.
4. What does your agent exclude from antivirus, and could those exclusions be narrower?
5. Where are our backups, and could your tool delete them? At least one copy should be offline or immutable and not reachable with the same admin account that runs the agent. Ask when they last restored from it.
6. What happens on a Friday night? Who is on call, and how will they tell us if their tool is compromised? Kaseya's "shut it down now" message only helped the MSPs who read it in time.
7. Can we have a list of accounts with admin rights on our machines, and an alert when it changes?
What limits a remote-management agent
• Fewer machines with the agent. Kiosks, tills and a server that rarely changes may not need always-on remote scripting.
• Application control (Windows Defender Application Control or AppLocker) so an unknown agent.exe in a temp folder won't start, even from SYSTEM.
• Tamper protection in Microsoft Defender, which blocks the Set-MpPreference switch-off used here when the setting is managed centrally.
• No standing admin. Admin accounts used for maintenance are switched on when needed, not left live all year.
• Your own sign-ins don't go through the MSP's tool. Customer-facing logins on your website should be separate from IT admin, so one compromise doesn't hand over both.
Supply chain attacks reach you through someone you trust to change your systems. Two more: 3CX 2023, a signed desktop app with a backdoor that began at another vendor, and Change Healthcare 2024, a remote-access portal without MFA.
Every login page you run is a door like Kaseya's VSA console. osec Scan lists admin, VPN and file-transfer login pages exposed on a host and matches them to CISA's known-exploited catalog. Free, paste a domain.
Scan a hostSources: Huntress: Rapid response, Kaseya VSA mass MSP ransomware incident; DIVD: report DIVD-2021-00002, Kaseya VSA; Cisco Talos: REvil ransomware actors attack Kaseya; CSO Online: The Kaseya ransomware attack, a timeline; BankInfoSecurity: Kaseya vulnerabilities first spotted in April; BankInfoSecurity: FBI Director questioned over Kaseya decryption key; BleepingComputer: REvil hacker behind Kaseya ransomware attack gets 13 years in prison; Security Affairs: Kaseya releases patches for flaws exploited in the ransomware attack; CISA: Kaseya VSA supply-chain ransomware attack guidance.