REvil Supply Chain Ransomware Attack Hits 200 US Companies
The cybercriminal group known as REvil and infamous for its ransomware activities executed another successful attack on a disturbing scale late last week.
Security researchers with Huntress Labs stated they believe the attack that affected at least two hundred US businesses is the work of the REvil cyber gang. This time the hackers did not work to infiltrate each company's network individually.
Instead, they pulled off what is commonly called a "supply chain attack". REvil abused a legitimate software supplier company called Kaseya. Kaseya delivers network management and IT infrastructure products and services to a large number of customers, ranging from average businesses to big companies.
Of course, Kaseya issued an official statement and a warning for server owners to shut down any and all servers running the software package that REvil used as the middle-man to execute the attack. The company also shut down its own software-as-a-service platform in response to the REvil activity.
While Kaseya initially intended to bring its SaaS back online by early morning on July 7th, but The Register reported today that the process has been delayed by "at least ten hours".
The REvil ransomware gang asked for a stunning $70 million in ransom payment. The demand may seem ludicrous, given that JBS, America's largest meat supplier, was hit by REvil about a month ago and in that attack the ransom demand was $11 million. The catch here is that using a supply chain attack in this new incident, REvil affected hundreds of businesses, not just in the US but across the world.
Not just internal business networks but also schools and supermarkets have been left hanging. Reuters reported that as collateral from the same attack, Swedish supermarket chain Coop was forced to close the doors of 800 of its stores, as the Internet-connected cash registers would simply not work.
Yahoo News quoted security expert Brett Callow who claimed that while there have been ransomware attacks that employed similar supply chain attack methods, they have all been "fairly minor" compared to the scale of the latest REvil job.
The timing of the attack seems to have been pre-meditated as well, as it coincided with the 4th of July Weekend holidays in the US, making rapid response to the threat more difficult than usual.
