How the Kaseya mass ransomware happened

Learn how the Kaseya ransomware attack was made possible.
In this webinar, we will guide you through: How it happened, the implications, ways it could have been avoided, how to identify indicators of attack, how the malware was deployed, and what it actually did.

#kaseyaVSA #ransomware #cyberattack

Together with Truesec Experts:
Rasmus Grönlund, Cybersecurity specialist
Fabio Viggiani, Technical Lead, cybersecurity

Questions we answer up to in the webinar:
1.What happened ?
2. Who is affected?
3. How did the VSA systems get compromised?
4. What was killchain - how did things get executed
5. What is the impact on affected resources?
6. What should one that has been affected do?

7. What is happening now to fix this?

Q/A

[fhalaris]

Very interesting information. I work at an affected store in Sweden. It's been some worrying days. But now some IT guy fixed some of the computers.

[ianmcpherson]

It will be interesting to see who buys out Kaseya in the next few months. Which of the other big players will "take advantage" of their demise and revaluation to swoop on the wounded company.

[RevealtechnologyNet]

Hosted Kaseya behind a VPN would have stopped it. It's the public exposure to the Internet that made it possible to get in.

[danneb]

When warned about the zero-day, why didn't Kaseya just immediately advice their customers to promptly isolate the systems from, at least, unprotected access from the Internet? The flav making the zero-day effective is obviously the Internet connected systemes having too weak (no!) protection from access.

[ella]

Funny how individuals are also not safe from ransomware attack.

Hosting your website on AWS is what i think its the best bet if you
chose a good machine image to start from. Most of the image available on
AWS have good security built in. But you need to be fairly proficient
on web server management to make sure you have your server secure as
possible.

You also need to make sure the code you are running on your AWS instance is good and solid.

The big thing you want to make sure you have in place is a good recovery
system. Meanwhile a cybersecurity firm like horuxx, com offers services
ranging from hack-tracing to recovery to both companies and individuals
and they are reliable too, started using them when i kept getting
attacked

Hackers are capable of hijacking almost anything on the internet, the
best you can do is make it more difficult to get your application so
they move to somebody else.

[josearnaldopinheirodossant]

IQLL, is a big problem I have in my 4 hd's . . .

[aszthrotep]

You never get 100% of the files decrypted after you pay. At best you can get around 65% decrypted/returned files. Take the loss and hunt them down.

[ShadCollins]

This just rambles and isn't very specific. Not sure what the target audience is for this.

[PassionataDance]

Sophisticated attack. Must be state sponsored.