Kaseya obtains REvil decryptor, starts sharing it with afflicted customers

July 23, 2021 TH Author

Software-for-services providers business Kaseya has obtained a “universal decryptor key” for the REvil ransomware and is delivering it to clients.

A brief Thursday update to the company’s rolling security advisory states the company received the key on July 21st.

“We can confirm that Kaseya obtained the tool from a third party and have teams actively helping customers affected by the ransomware to restore their environments, with no reports of any problem or issues associated with the decryptor,” the update states.

The update doesn’t reveal the source of the decryptor, but did say Kaseya had enlisted the help of a security services outfit named Emsisoft to help its customers cleanse their systems of malware.

Customers who need that help will hear from Kaseya.

The decryptor will doubtless be welcome, as flaws in Kaseya’s VSA module saw at least 50 Kaseya users compromised. As many of those customers were managed services providers, around 1500 organisations fell victim to the REvil ransomware. US President Joe Biden called on Russia to get ransomware purveyors operating from its soil under control in the wake of the incident, and the operators of REvil mysteriously disappeared from the internet within two days of that call.

Something that has not disappeared is the need for Kaseya customers to keep patching their software, as the company has issued two further patches in recent days.

Release 9.5.7.3015 was progressively applied to SaaS instances from July 17th and was offered to on-prem users on July 20th. The release addressed “functionality issues caused by the enhanced security measures put in place and provides bug fixes”.

The bugs quashed in the update are not security related.

A further Quick Fix Engineering Release issued on July 22nd is security related, as one of the things it fixes is “an issue where Anti-Virus and Anti-Malware clients failed to install or uninstall”. ®