homepage
Open menu
Go one level top
  • Train and Certify
    • Overview
    • Get Started in Cyber
    • Courses
    • GIAC Certifications
    • Training Roadmap
    • OnDemand
    • Live Training
    • Summits
    • Cyber Ranges
    • College Degrees & Certificates
    • Scholarship Academies
    • NICE Framework
    • Specials
  • Manage Your Team
    • Overview
    • Group Purchasing
    • Why Work with SANS
    • Build Your Team
    • Hire Cyber Talent
    • Team Development
    • Private Training
    • Security Awareness Training
    • Leadership Training
    • Industries
  • Resources
    • Overview
    • Internet Storm Center
    • White Papers
    • Webcasts
    • Tools
    • Newsletters
    • Blog
    • Podcasts
    • Posters & Cheat Sheets
    • Summit Presentations
    • Security Policy Project
  • Focus Areas
    • Cyber Defense
    • Cloud Security
    • Digital Forensics & Incident Response
    • Industrial Control Systems
    • Cyber Security Leadership
    • Offensive Operations
  • Get Involved
    • Overview
    • Join the Community
    • Work Study
    • Teach for SANS
    • CISO Network
    • Partnerships
    • Sponsorship Opportunities
  • About
    • About SANS
    • Our Founder
    • Instructors
    • Mission
    • Diversity
    • Awards
    • Contact
    • Frequently Asked Questions
    • Customer Reviews
    • Press
  • SANS Sites
    • GIAC Security Certifications
    • Internet Storm Center
    • SANS Technology Institute
    • Security Awareness Training
  • Search
  • Log In
  • Join
    • Account Dashboard
    • Log Out
  1. Home >
  2. Blog >
  3. Enterprise Security Tech Q&A
370x370_ryan-chapman.jpg
Ryan Chapman

Enterprise Security Tech Q&A

Ryan Chapman speaks on the Kaseya ransomware attack.

July 9, 2021

In response to the Kaseya ransomware attack Ryan Chapman, SANS Certified Instructor Candidate, speaks on identifying the attack affiliate, navigating the aftermath of the attack, possible future cybercriminal activity, and the importance congress must place in drafting legislation curbing ransomware.

1. Why will identifying the origin of the attack be increasingly difficult? 

Identifying the origin of a ransomware attack can be easy or difficult, depending on your viewpoint. To begin, we know an affiliate of the REvil Gang perpetrated the attack. In most ransomware cases these days, the groups are brazen about announcing who they are. This is a boisterous game of "WE DID THIS!" rather than a silent, hiding in the shadow’s thing. In that regard, the matter of finger-pointing to the overall association involved is simple. 

A more complicated matter is that of identifying the actual affiliate who carried out the attack. With the Kaseya attack, a key matter of importance is identifying the initial access broker (IAB). Ransomware attacks are carried out by various teams, each of whom plays a specific role in the attack. In this case, initial access was gained via the exploitation of a "0-day" vulnerability. 

The Kaseya case is an ongoing incident, and we as a threat intelligence community do not yet know what affiliates of REvil might be responsible for the attack. The possibility exists that events may unfold in certain forums involving one side or the other providing more information to the public. For that matter, ransomware operators and their affiliates have in the past disagreed to the point of instituting courtroom-like hearings. We won't know what to expect until more time has passed. 

2. How can Kaseya best navigate the aftermath of the attack? 

The best way for Kaseya to navigate the aftermath of this attack is for them to be as transparent as possible. The firm is currently working around the clock, and their dedication to updates on the matter shows. Kaseya's CEO, Fred Voccola, recently addressed the Kaseya community on July 5, 2021. 

While the company has been working hard to respond to the incident, the community at large still has questions that will need to be answered. An organization named DIVD CSIRT has stated that they notified Kaseya of multiple vulnerabilities earlier in April of this year. We in the community would absolutely love additional information from Kaseya on this - if the company had pre-knowledge of vulnerabilities leveraged in the attack, they might have been working on a fix. Patching is not an easy task, especially with a system as complicated as theirs. 

Some people will scream, "they had 90 days!" while others recognize that timelines don't always play out so easily. We could also learn that the vulnerabilities disclosed to them in April weren’t even involved here, at which point bashing the company over current theories is just silly. 

3. What are the far-reaching implications of the attack and how it could be leveraged for future cybercriminal activity? 

This latest REvil ransomware attack involving Kaseya is not "new." Sure, the vulnerability exploited was new, but otherwise, things are reminiscent of what we've seen in the past. The overarching goal was simple: attack a vendor platform capable of granting access to additional targets (your MSPs, MSSPs, etc.). 

While various implications loom, my fear is that this method of attacking those with visibility and access to numerous companies will increase. The attack vector isn't new, but it could become more enticing given the visibility this incident has in the public eye. I'm also worried about the $70MUSD price tag for a universal decryptor. That price may not sound legitimate at first. But for the companies who were hit with $5m/$10m ransoms, banding together to minimize individual company payment may eventually seem like a good idea. And that's what worries me; we could experience a greater push for companies to band together to support the enemy. 

4. Why is incorporating feedback from ransomware negotiators and cyber professionals prior to drafting legislation aimed at curbing ransomware so important? 

Any form of legislation dealing with ransomware could have a major impact on organizations and security professionals. To better understand those impacts, Congress should do their best to engage everyone who is involved with ransomware. The business, financial, reputation, personal, and other impacts of ransomware are different for everyone involved, and we need to recognize that when making broad policy decisions. Those involved can include victim organizations, incident responders, legal counsel, insurance companies, negotiators, and more, all of whom are be impacted differently by ransomware. Changing how they deal with an attack through legislation must take their experiences into account as not doing do could increase the impact of an attack rather than mitigate it. We also have to understand how threat actors might react to legislation like changing tactics that might make it more difficult to handle an attack. The true impact of any potential legislation can only be known once each and every one of the general roles involved has been probed for feedback. 

The popular topic of discussion these days involves making ransom payments illegal. Let's keep these country agnostics for now -- Taking that as an example, what is the governing body behind the legislation going to do to ease the burden of not having payment as an option? Many organizations who pay a ransom do so because they feel they have no other choice. Sure, some organizations perform a cost analysis and thus determine that paying the ransomware will be "less expensive" to them. Yet many organizations feel as though not paying the ransom will force them into extinction. I believe that these types of decisions should be reviewed, and a system of ethics must be applied. If that system is utilitarian in nature, that could mean that organizations begin to willingly break the law to work with ransomware actors. Why might they do so? Where is the money *really* going when a ransom is paid? What if such legislation leads to the next level of extortion? Would Ransomware Group X dare exfiltrate data, encrypt the network, receive payment to destroy data plus decrypt the network (at least promise to do so), only to then later return with the threat of making public the fact that the organization paid them? Then what? The push to draft, impose, and enforce legislation concerning ransomware is growing. I just hope that those involved do a thorough job of getting feedback on the true implications should a given piece of legislation become reality.

Click here to learn more about Ryan and view his upcoming courses!
Share:
TwitterLinkedInFacebook
Copy url Url was copied to clipboard
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe

Tags:
  • Digital Forensics and Incident Response

Related Content

Blog
FOR500_update.png
Digital Forensics and Incident Response
April 19, 2022
SANS FOR500: Windows Forensic Analysis - Updated for Windows 11 and Beyond
The new release of the FOR500 Windows Forensic Analysis course includes a significant focus to support the new Windows 11 operating system and more.
370x370_Chad-Tilbury.jpg
Chad Tilbury
read more
Blog
DFIR_Summit_Blog.png
Digital Forensics and Incident Response
July 23, 2021
A Visual Summary of SANS DFIR Summit 2021
SANS DFIR Summit was a free, global, virtual event for the community. Check out these graphic recordings created in real-time throughout the Summit.
Emily Blades
read more
Blog
Digital Forensics and Incident Response
July 6, 2021
Executives and Ransomware: Stop, Collaborate, and Listen! Webcast Q&A
James Shank of Team Cymru and Ryan Chapman of SANS answer questions on the top themes for ransomware preparedness.
370x370_ryan-chapman.jpg
Ryan Chapman
read more
  • Register to Learn
  • Courses
  • Certifications
  • Degree Programs
  • Cyber Ranges
  • Job Tools
  • Security Policy Project
  • Posters & Cheat Sheets
  • White Papers
  • Focus Areas
  • Cyber Defense
  • Cloud Security
  • Cyber Security Leadership
  • Digital Forensics
  • Industrial Control Systems
  • Offensive Operations
Subscribe to SANS Newsletters
Receive curated news, vulnerabilities, & security awareness tips
United States
Canada
United Kingdom
Spain
Belgium
Denmark
Norway
Netherlands
Australia
India
Japan
Singapore
Afghanistan
Aland Islands
Albania
Algeria
American Samoa
Andorra
Angola
Anguilla
Antarctica
Antigua and Barbuda
Argentina
Armenia
Aruba
Austria
Azerbaijan
Bahamas
Bahrain
Bangladesh
Barbados
Belarus
Belize
Benin
Bermuda
Bhutan
Bolivia
Bonaire, Sint Eustatius, and Saba
Bosnia And Herzegovina
Botswana
Bouvet Island
Brazil
British Indian Ocean Territory
Brunei Darussalam
Bulgaria
Burkina Faso
Burundi
Cambodia
Cameroon
Cape Verde
Cayman Islands
Central African Republic
Chad
Chile
China
Christmas Island
Cocos (Keeling) Islands
Colombia
Comoros
Cook Islands
Costa Rica
Croatia (Local Name: Hrvatska)
Curacao
Cyprus
Czech Republic
Democratic Republic of the Congo
Djibouti
Dominica
Dominican Republic
East Timor
East Timor
Ecuador
Egypt
El Salvador
Equatorial Guinea
Eritrea
Estonia
Ethiopia
Falkland Islands (Malvinas)
Faroe Islands
Fiji
Finland
France
French Guiana
French Polynesia
French Southern Territories
Gabon
Gambia
Georgia
Germany
Ghana
Gibraltar
Greece
Greenland
Grenada
Guadeloupe
Guam
Guatemala
Guernsey
Guinea
Guinea-Bissau
Guyana
Haiti
Heard And McDonald Islands
Honduras
Hong Kong
Hungary
Iceland
Indonesia
Iraq
Ireland
Isle of Man
Israel
Italy
Jamaica
Jersey
Jordan
Kazakhstan
Kenya
Kingdom of Saudi Arabia
Kiribati
Korea, Republic Of
Kosovo
Kuwait
Kyrgyzstan
Lao People's Democratic Republic
Latvia
Lebanon
Lesotho
Liberia
Liechtenstein
Lithuania
Luxembourg
Macau
Macedonia
Madagascar
Malawi
Malaysia
Maldives
Mali
Malta
Marshall Islands
Martinique
Mauritania
Mauritius
Mayotte
Mexico
Micronesia, Federated States Of
Moldova, Republic Of
Monaco
Mongolia
Montenegro
Montserrat
Morocco
Mozambique
Myanmar
Namibia
Nauru
Nepal
Netherlands Antilles
New Caledonia
New Zealand
Nicaragua
Niger
Nigeria
Niue
Norfolk Island
Northern Mariana Islands
Oman
Pakistan
Palau
Palestine
Panama
Papua New Guinea
Paraguay
Peru
Philippines
Pitcairn
Poland
Portugal
Puerto Rico
Qatar
Reunion
Romania
Russian Federation
Rwanda
Saint Bartholemy
Saint Kitts And Nevis
Saint Lucia
Saint Martin
Saint Vincent And The Grenadines
Samoa
San Marino
Sao Tome And Principe
Senegal
Serbia
Seychelles
Sierra Leone
Sint Maarten
Slovakia (Slovak Republic)
Slovenia
Solomon Islands
South Africa
South Georgia and the South Sandwich Islands
South Sudan
Sri Lanka
St. Helena
St. Pierre And Miquelon
Suriname
Svalbard And Jan Mayen Islands
Swaziland
Sweden
Switzerland
Taiwan
Tajikistan
Tanzania
Thailand
Togo
Tokelau
Tonga
Trinidad And Tobago
Tunisia
Turkey
Turkmenistan
Turks And Caicos Islands
Tuvalu
Uganda
Ukraine
United Arab Emirates
United States Minor Outlying Islands
Uruguay
Uzbekistan
Vanuatu
Vatican City
Venezuela
Vietnam
Virgin Islands (British)
Virgin Islands (U.S.)
Wallis And Futuna Islands
Western Sahara
Yemen
Yugoslavia
Zambia
Zimbabwe
  • © 2022 SANS™ Institute
  • Privacy Policy
  • Contact
  • Careers
  • Twitter
  • Facebook
  • Youtube
  • LinkedIn