{"id":1418,"date":"2021-07-07T22:30:00","date_gmt":"2021-07-07T22:30:00","guid":{"rendered":"https:\/\/www.pax8.com\/future-blog\/kaseya-ransomware\/"},"modified":"2023-05-17T14:29:23","modified_gmt":"2023-05-17T14:29:23","slug":"kaseya-ransomware","status":"publish","type":"post","link":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/","title":{"rendered":"What you need to know about the Kaseya Ransomware Attack"},"content":{"rendered":"

Read recommendations from Pax8 security vendors.<\/p>\n

On Friday, July 2, 2021, hackers launched a sophisticated ransomware attack on Kaseya\u2019s<\/a> remote management Virtual System\/Server Administrator (VSA) software, compromising the IT service providers who use the tool as well as their downstream clients. On Monday, July 5, the hackers demanded a $70 million ransom to provide a decryption tool.<\/p>\n

Pax8 and our security vendors have been closely monitoring the developments related to the ransomware attack on the Kaseya VSA\u00a0product\u00a0since it was announced. Kaseya and many Pax8 vendors are providing regular updates to clients and reseller partners about the situation, including instructions on how to protect their businesses.<\/p>\n

#1 Recommendation<\/h2>\n

Key among the current recommendations from Kaseya is that all on-premises VSA servers should continue to remain offline until further instructions are issued by Kaseya about when it is safe to restore operations.<\/strong><\/p>\n

\u00a0<\/strong><\/p>\n

Security Vendor Recommendations<\/h2>\n

Below are some extracts from Pax8 security vendor communications after the attack.<\/p>\n

Bitdefender<\/strong><\/a> (as of July 2)<\/strong><\/p>\n

“Kaseya issued an advisory and has urged their customers to immediately shut down on-premises VSA servers. We recommend that any Kaseya VSA users follow this guidance immediately\u2026 Check on-premises and hybrid environments for known indicators of compromise (IoCs).”<\/p>\n

Proofpoint<\/strong><\/a> (as of July 5)<\/strong><\/p>\n

“Proofpoint has a limited number of Kaseya servers supporting non-production environments. We shut these servers down as requested on July 2nd, and they remain shut down pending further information from Kaseya. Proofpoint has reviewed all known indicators of compromise and at this point has not seen any evidence that we have been impacted by the attack.”<\/p>\n

SentinelOne<\/strong><\/a> (as of July 3)<\/strong><\/p>\n

“SentinelOne agents protect from this supply chain attack. Our teams will continue to hunt and search for any indications of this attack 24\/7\/365. We\u2019re also working to ensure no exclusions were set that could allow the attack to occur.”<\/p>\n

NovaSOC<\/strong><\/a> (as of July 2)<\/strong><\/p>\n

“Kaseya is recommending VSA servers be shut down immediately. They have not indicated their cloud\/SaaS solutions are definitively impacted but those servers appear to be down for maintenance at this time, likely to preserve the environment during their in-house investigation.”<\/p>\n

Stay on Top of Security Vendor Updates<\/h2>\n

To help our partner community stay on top of the issue, Pax8 is compiling the complete client and partner advisories from our security vendors and making them available at the link below. We will continue to update this resource as new advisories are issued.<\/p>\n

Explore security resources<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Read recommendations from Pax8 security vendors. On Friday, July 2, 2021, hackers launched a sophisticated ransomware attack on Kaseya\u2019s remote management Virtual System\/Server Administrator (VSA) software, compromising the IT service providers who use the tool as well as their downstream clients. On Monday, July 5, the hackers demanded a $70 million ransom to provide a […]<\/p>\n","protected":false},"author":141,"featured_media":224,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4,7,5],"tags":[31],"class_list":["post-1418","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-msp","category-pax8-partners","category-security","tag-ransomware"],"acf":[],"yoast_head":"\nWhat you need to know about the Kaseya Ransomware Attack - Pax8 Blog<\/title>\n<meta name=\"description\" content=\"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What you need to know about the Kaseya Ransomware Attack - Pax8 Blog\" \/>\n<meta property=\"og:description\" content=\"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"Pax8 Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-07T22:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-17T14:29:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2000\" \/>\n\t<meta property=\"og:image:height\" content=\"1047\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"narnold\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"narnold\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/\"},\"author\":{\"name\":\"narnold\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/person\\\/4f1f5ecebcf730cc2be7b763a310a63c\"},\"headline\":\"What you need to know about the Kaseya Ransomware Attack\",\"datePublished\":\"2021-07-07T22:30:00+00:00\",\"dateModified\":\"2023-05-17T14:29:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/\"},\"wordCount\":408,\"publisher\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/MicrosoftTeams-image-24_adobespark-1.png\",\"keywords\":[\"ransomware\"],\"articleSection\":[\"MSPs\",\"Pax8 partners\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/\",\"name\":\"What you need to know about the Kaseya Ransomware Attack - Pax8 Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/MicrosoftTeams-image-24_adobespark-1.png\",\"datePublished\":\"2021-07-07T22:30:00+00:00\",\"dateModified\":\"2023-05-17T14:29:23+00:00\",\"description\":\"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/MicrosoftTeams-image-24_adobespark-1.png\",\"contentUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/MicrosoftTeams-image-24_adobespark-1.png\",\"width\":2000,\"height\":1047,\"caption\":\"Kaseya ransomware attack\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/kaseya-ransomware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What you need to know about the Kaseya Ransomware Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\",\"name\":\"Pax8 Blog\",\"description\":\"Where IT pros go to keep up with the cloud\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#organization\",\"name\":\"Pax8 Blog\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/pax8-logo-white-blog-300x300-1.png\",\"contentUrl\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/13\\\/2023\\\/03\\\/pax8-logo-white-blog-300x300-1.png\",\"width\":300,\"height\":300,\"caption\":\"Pax8 Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/#\\\/schema\\\/person\\\/4f1f5ecebcf730cc2be7b763a310a63c\",\"name\":\"narnold\",\"url\":\"https:\\\/\\\/www.pax8.com\\\/blog\\\/author\\\/narnold\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What you need to know about the Kaseya Ransomware Attack - Pax8 Blog","description":"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"What you need to know about the Kaseya Ransomware Attack - Pax8 Blog","og_description":"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.","og_url":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/","og_site_name":"Pax8 Blog","article_published_time":"2021-07-07T22:30:00+00:00","article_modified_time":"2023-05-17T14:29:23+00:00","og_image":[{"width":2000,"height":1047,"url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png","type":"image\/png"}],"author":"narnold","twitter_card":"summary_large_image","twitter_misc":{"Written by":"narnold","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/"},"author":{"name":"narnold","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/person\/4f1f5ecebcf730cc2be7b763a310a63c"},"headline":"What you need to know about the Kaseya Ransomware Attack","datePublished":"2021-07-07T22:30:00+00:00","dateModified":"2023-05-17T14:29:23+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/"},"wordCount":408,"publisher":{"@id":"https:\/\/www.pax8.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png","keywords":["ransomware"],"articleSection":["MSPs","Pax8 partners","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/","url":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/","name":"What you need to know about the Kaseya Ransomware Attack - Pax8 Blog","isPartOf":{"@id":"https:\/\/www.pax8.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png","datePublished":"2021-07-07T22:30:00+00:00","dateModified":"2023-05-17T14:29:23+00:00","description":"Read recommendations from Pax8 security vendors on what actions to take regarding the Kaseya ransomware attack.","breadcrumb":{"@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#primaryimage","url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png","contentUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/MicrosoftTeams-image-24_adobespark-1.png","width":2000,"height":1047,"caption":"Kaseya ransomware attack"},{"@type":"BreadcrumbList","@id":"https:\/\/www.pax8.com\/blog\/kaseya-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pax8.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What you need to know about the Kaseya Ransomware Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.pax8.com\/blog\/#website","url":"https:\/\/www.pax8.com\/blog\/","name":"Pax8 Blog","description":"Where IT pros go to keep up with the cloud","publisher":{"@id":"https:\/\/www.pax8.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pax8.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pax8.com\/blog\/#organization","name":"Pax8 Blog","url":"https:\/\/www.pax8.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/pax8-logo-white-blog-300x300-1.png","contentUrl":"https:\/\/www.pax8.com\/blog\/wp-content\/uploads\/sites\/13\/2023\/03\/pax8-logo-white-blog-300x300-1.png","width":300,"height":300,"caption":"Pax8 Blog"},"image":{"@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.pax8.com\/blog\/#\/schema\/person\/4f1f5ecebcf730cc2be7b763a310a63c","name":"narnold","url":"https:\/\/www.pax8.com\/blog\/author\/narnold\/"}]}},"_links":{"self":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts\/1418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/users\/141"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/comments?post=1418"}],"version-history":[{"count":0,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/posts\/1418\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/media\/224"}],"wp:attachment":[{"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/media?parent=1418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/categories?post=1418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pax8.com\/blog\/wp-json\/wp\/v2\/tags?post=1418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}