Criminals target Kaseya victims with fake Microsoft update
Victimizing the victims of REvil ransomware attack
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityresearchers have found evidence of an opportunistic email campaign to trick the victims of the Kaseya-REvilransomwareattack to take control over the functional machines in their network.
The notorious REvil gang conducted a massive supply chainransomware attacklate last week, which according to conservative estimates has affected thousands of businesses around the world.
TheMalwarebytesThreat Intelligence Team has nowshared detailsof a malspam campaign that falsely promises to deliver aMicrosoftsecurity update to help fix the vulnerability in Kaseya software that was exploited by REvil to deploy ransomware.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
Click here to start the survey in a new window«
Although REvil claims to have infected over a million machines,Kaseya CEO Fred Voccolahas said it was difficult to pin down the exact number of targets, since the victims were customers of its customers.
New malspam campaign
In a live blog, tracking the developments related to this particular ransomware campaign, Malwarebytes researchers have shared details of an email that is playing on the insecurities of victims, by offering them an update to help patch the Kaseya vulnerability.
“Guys please install the update from Microsoft to protect against ransomware as soon as possible. This is fixing a vulnerability in Kaseya,” reads the spurious email.
However, in the guise of the update, the attachment in the emails instead delivers the penetration testing software Cobalt Strike, which the attackers use to break into the victims’ network and machines.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Malwarebytes hasn’t speculated about the identity of the group behind this new malspam campaign.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
How to watch Wolf Hall: The Mirror and the Light FREE online from anywhere
