On July 2, 2021 - the Friday before the Fourth of July holiday weekend in the United States - REvil (also known as Sodinokibi), one of the most prolific ransomware groups of the era, executed what was at the time the largest ransomware attack in history. The group exploited a zero-day vulnerability in Kaseya VSA, a remote monitoring and management (RMM) software platform widely used by managed service providers (MSPs). By targeting the MSP tool rather than individual victims, REvil amplified a single attack into simultaneous ransomware deployments across between 800 and 1,500 businesses in at least 17 countries.

The attack was a supply chain ransomware deployment: rather than compromising each victim individually, REvil compromised the infrastructure that MSPs used to manage their clients, then used that trusted administrative access to push the ransomware to every endpoint under management. From one point of access to a Kaseya VSA server, an attacker could encrypt thousands of endpoints across dozens of unrelated organizations. The demand was $70 million for a universal decryptor that would unlock all victims simultaneously - the largest single ransom demand ever made.

The Kaseya VSA Vulnerability

Kaseya VSA is an agent-based RMM platform: MSPs install the VSA agent on client endpoints, and VSA provides centralized management, patch deployment, script execution, and remote access to all managed devices. The VSA server can push any command or software to every managed endpoint simultaneously. This makes it an extremely high-value target - control the VSA server, control everything it manages.

REvil exploited a chain of vulnerabilities in Kaseya VSA's web interface: an authentication bypass (CVE-2021-30116) combined with a SQL injection (CVE-2021-30119) and a credential leak (CVE-2021-30120). The authentication bypass allowed unauthenticated access to certain VSA API endpoints. Through those endpoints, the attackers could execute commands on the VSA server with the privileges of the VSA service account. Once they had server-level access, they used VSA's own legitimate management functionality to deploy the REvil ransomware binary to all connected agent endpoints.

The attack used a clever evasion technique: the ransomware was deployed as a legitimate Kaseya VSA "managed service" update. The ransomware binary was Base64-encoded and embedded in a PowerShell script disguised as a Kaseya software update. Because endpoint security tools were often configured to trust Kaseya VSA commands (since VSA itself was the management platform), the ransomware deployment bypassed many security controls. The script also disabled Windows Defender before deploying the payload.

[TECHNICAL NOTE]
The Kaseya VSA attack chain: (1) REvil identified Kaseya VSA on-premise servers exposed to the internet (VSA servers must be reachable from managed endpoints; many MSPs exposed them publicly). (2) Authentication bypass via CVE-2021-30116 allowed unauthenticated posting to the userFilterTableRpt.asp endpoint, bypassing authentication checks. (3) SQL injection via CVE-2021-30119 in the reporting endpoint allowed extraction of VSA credentials and session tokens. (4) With authenticated VSA access, the attacker used VSA's built-in "Procedure" functionality - VSA's scripting/automation system - to deploy a PowerShell script to all connected agents. (5) The PowerShell script: disabled real-time protection in Windows Defender, encoded the REvil binary in base64 within the script itself, decoded and wrote it to disk, and executed it. (6) REvil encrypted files using a Salsa20 cipher with an RSA-8192 public key embedded in the binary. Each victim received a unique ransom note with a unique victim ID tied to the key exchange infrastructure. DUTCH NCSC and CISA published joint advisories; Kaseya was informed of the vulnerabilities by the Dutch Institute for Vulnerability Disclosure (DIVD) prior to the attack - the company was in the process of patching when REvil struck.

Scale, Victims, and the Holiday Timing

The July 4th holiday weekend timing was not accidental. REvil had previously used holiday weekends for major attacks - the DarkSide Colonial Pipeline attack on May 7 was also before a holiday. Security operations centers are typically understaffed on holidays; incident response teams take days off; the time between attack deployment and organizational detection stretches. By the time many affected organizations realized what had happened, entire weekends had passed with ransomware running unchecked.

Among the most visible victims was Coop, the Swedish supermarket chain. Coop's IT provider used Kaseya VSA; when the provider's systems were hit, the ransomware propagated to Coop's point-of-sale terminals. Nearly 800 Coop stores were forced to close because their cash registers stopped working. Swedish citizens photographed darkened supermarket chains on a Saturday afternoon. A kindergarten, dentistry offices, and pharmacies in Sweden were among victims. The attack highlighted that critical consumer infrastructure - grocery stores, pharmacies - was exposed to supply chain ransomware risk through their MSP dependencies.

Total victims ranged from 800 to 1,500 organizations depending on the counting methodology. Most were SMBs served by MSPs that used Kaseya VSA. The scale was unprecedented for a single ransomware deployment.

[WARNING]
The Kaseya attack demonstrated that MSP RMM platforms are one of the highest-risk vectors in the enterprise security ecosystem. An MSP can serve hundreds of clients from a single VSA installation; a compromise of that VSA installation gives an attacker the same administrative access the MSP uses to manage all client environments. REvil and other ransomware groups recognized this amplification factor early - Managed Service Providers became primary ransomware targets from approximately 2019 onward. CISA subsequently issued guidance specifically addressing MSP security, including requirements that MSPs apply the same security controls to their management infrastructure that they apply to client environments, that MSP administrative tools be placed behind MFA and restricted to known IP addresses, and that MSP tools not be exposed directly to the internet without VPN or zero-trust access controls. The "trusted supplier becomes attack vector" pattern is the MSP version of the SolarWinds and Kaseya supply chain attacks - the trust relationship that makes MSPs valuable (centralized administrative access) is exactly what makes them valuable to attackers.

REvil's Disappearance and Return

REvil's $70 million demand for the universal decryptor was never paid - no single entity controlled all victims, and no coordination mechanism existed for such a payment. Individual victims negotiated separately. Some paid; most either restored from backups or accepted the data loss. The universal decryptor demand appeared to be theater, or at least an optimistic opening position.

Three weeks after the attack, on July 23, REvil's entire infrastructure went dark. The group's payment portal, data leak site ("Happy Blog"), and C2 servers all disappeared simultaneously. No explanation was given. The prevailing theory was that the Biden-Putin Geneva summit (June 2021) had created diplomatic pressure for Russia to act against ransomware groups, and that Russian intelligence had quietly told REvil to stand down. The FBI had separately obtained the universal Kaseya decryptor through a confidential source and shared it with victims in late July, recovering encrypted systems without payment.

REvil reappeared in September 2021 with new infrastructure. In October 2021, the US and allies conducted a multinational law enforcement operation that took down REvil's servers (again) and arrested multiple affiliates in Romania and South Korea. In January 2022, Russian FSB raided REvil members inside Russia, arresting eight individuals and seizing cryptocurrency and assets - an unusual step that many observers attributed to diplomatic pressure following the Biden-Putin summit rather than genuine Russian law enforcement interest in prosecuting ransomware operators.

[IOC]
Kaseya VSA / REvil indicators: the ransomware binary was deployed via Kaseya VSA as "agent.crt" (a Kaseya-themed filename). The PowerShell dropper script was named "agent.exe" or similar Kaseya-branded names. REvil encrypted files received the extension ".wbewn" or other random extensions per build. Ransom notes: "[extension]-readme.txt" in each encrypted directory pointing to an onion-hosted payment portal. VSA vulnerability CVEs: CVE-2021-30116 (authentication bypass), CVE-2021-30119 (XSS/SQL injection), CVE-2021-30120 (2FA bypass). Kaseya VSA on-premises installations should have been updated to 9.5.7 (released July 11, 2021) or later immediately. Kaseya released detection tools and indicators; CISA advisory AA21-189A covers Kaseya VSA and MSP RMM security. REvil Bitcoin payment infrastructure used unique addresses per victim; Chainalysis tracked REvil's total 2021 receipts at approximately $11 million (confirmed payments only). The arrested Russian REvil members included Yaroslav Vasinskyi (Ukrainian, extradited to US, sentenced 13 years) and Yevgeniy Polyanin (Russian, indicted).