REvil demands $70M to end Kaseya ransomware attack

Russia-linked ransomware gang REvil on Sunday claimed responsibility for the recent hack of IT management firm Kaseya, an attack that impacted more than a thousand companies around the world.

In a post to its dark web blog, REvil took credit for the hack and said it will release a universal decryptor to unlock all affected computers for $70 million in Bitcoin, The Record reports. The group invited interested parties to make contact for negotiations.

"On Friday (02.07.2021) we launched an attack on MSP providers. More than a million systems were infected. If anyone wants to negotiate about universal decryptor - our price is 70 000 000$ in BTC and we will publish publicly decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour. If you are interested in such deal - contact us using victims "readme" file instructions," REvil said in the post.

Intelligence agencies investigating the case believed REvil to be behind the attack, though they lacked confirmation until Sunday. The hacking group previously targeted meat processing company JBS and in April threatened to leak "confidential drawings of personal data with several major brands" after hacking systems owned by Apple supplier Quanta. JBS paid an $11 million ransom to protect its data, while Quanta was at one point in talks to pay out $20 million.

As noted by Gizmodo on Monday, REvil's Kaseya hack last Friday is known as a supply chain ransomware attack, meaning malicious code is inserted into a software vendor's network and subsequently distributed to customers.

REvil is thought to have leveraged an exploit in Kaseya's VSA cloud platform to gain access to customers' VSA appliances, which managed service providers (MSPs) use to provide remote support and software update support to smaller businesses. VSA platforms are also used by larger businesses to manage remote computer fleets.

According to The Record, REvil used the VSA access to deliver a malicious payload that encrypted local files on all connected computers.

In an update on Monday, Kaseya said it knew how the attack occurred and was working to fix the issue. The company instructed all customers to keep VSA servers offline until further notice.

Keep up with everything Apple in the weekly AppleInsider Podcast — and get a fast news update from AppleInsider Daily. Just say, "Hey, Siri," to your HomePod mini and ask for these podcasts, and our latest HomeKit Insider episode too.

If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple's Podcasts app, or via Patreon if you prefer any other podcast player.

Latest Exclusives

Latest comparisons

17 Comments

roake 10 Years · 820 comments

About 3 years ago

A few properly place Hellfire missiles from an affected country would bring this type of activity to a stop pretty fast.

pascal007 18 Years · 122 comments

roake said:

A few properly place Hellfire missiles from an affected country would bring this type of activity to a stop pretty fast.

No, it wouldn’t. And it would be the equivalent of a declaration of war against another country while the perpetrators of the crime are not acting in the country’s name but for themselves.

The perpetrators can easily move from one area to another. The missile attack would simply end up killing civilians that have nothing to do with the crime.

sflocal 16 Years · 6138 comments

pascal007 said:

roake said:

A few properly place Hellfire missiles from an affected country would bring this type of activity to a stop pretty fast.

No, it wouldn’t. And it would be the equivalent of a declaration of war against another country while the perpetrators of the crime are not acting in the country’s name but for themselves.

The perpetrators can easily move from one area to another. The missile attack would simply end up killing civilians that have nothing to do with the crime.

You’re right. It should be an explosive device under their car and set to go off remotely to minimize casualties. Enough of those go off against their key members and they will know they’re a target.

bloggerblog 16 Years · 2520 comments

sflocal said:

pascal007 said:

roake said:

A few properly place Hellfire missiles from an affected country would bring this type of activity to a stop pretty fast.

No, it wouldn’t. And it would be the equivalent of a declaration of war against another country while the perpetrators of the crime are not acting in the country’s name but for themselves.

The perpetrators can easily move from one area to another. The missile attack would simply end up killing civilians that have nothing to do with the crime.

You’re right. It should be an explosive device under their car and set to go off remotely to minimize casualties. Enough of those go off against their key members and they will know they’re a target.

If you can locate their cars you can locate them, a humiliating arrest and lifetime imprisonment would be much more effective endgame, it’ll set an example to others planning to do the same.

GeorgeBMac 8 Years · 11421 comments

pascal007 said:

roake said:

A few properly place Hellfire missiles from an affected country would bring this type of activity to a stop pretty fast.

No, it wouldn’t. And it would be the equivalent of a declaration of war against another country while the perpetrators of the crime are not acting in the country’s name but for themselves.

The perpetrators can easily move from one area to another. The missile attack would simply end up killing civilians that have nothing to do with the crime.

OK -- Russians have been attacking us since 2016. Enough that I'm losing count: Is it 5 or 6 attacks now?
What does it take to get us to respond?

20 years ago Afghanistan harbored people who attacked us. We went to full scale war with them (yeh, we kind of lost that war -- but we made our point). But, with Russians attacking us on an ongoing basis, it's time to respond (and we have a full range of options on how to respond - it doesn't have to be missles -- we could take out a few of their systems -- just like Biden threatened to do.)

BTW: Putin is telling the truth when he says the Russia has not attacked us. The Russian government didn't. But Putin's shills did -- and Putin supports and protects them.