Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:00 PM
Connect Directly

Customers of 3 MSPs Hit in Ransomware Attacks

Early information suggests threat actors gained access to remote monitoring and management tools from Webroot and Kaseya to distribute malware.

UPDATE: 06/21/2019 This story has been updated to reflect the fact that customers of at least three MSPs were impacted in the attacks, not just one MSP as previously reported.

Computers belonging to customers of at least three managed services providers have been hit with ransomware after attackers somehow gained access to tools used by the MSPs to remotely manage and monitor client systems.

Details of the attacks are still only emerging, and the full scope of the incidents or even the names of the MSPs are still not currently available. But early information suggests that attackers likely used two remote management tools at the MSPs — one from Webroot, the other from Kaseya — to distribute the ransomware. Both vendors have said the attackers appear to have used stolen credentials to access their tools at the MSP locations.

Comments on an MSP forum on Redditt, including from security researchers claiming close knowledge of the incidents, suggest one MSP is a large company and that many of its clients have been impacted.

A researcher from Huntress Labs, a firm that provides security services to MSPs, claimed on Reditt to have confirmation that the attackers used a remote management console from Webroot to execute a PowerShell based payload that in turn downloaded the ransomware on client systems. Webroot describes the console as allowing administrators to view and manage devices protected by the company's AV software.

According to the Huntress Labs researcher, the payload was likely 'Sodinokibi', a ransomware tool that encrypts data on infected systems and deletes shadow copy backups as well.

Kyle Hanslovan, CEO and co-founder of Huntress Lab says a customer of one MSP that was attacked, contacted his company Thursday and provided their Webroot management console logs for analysis.  "We don't know how the attacker gained access into the Webroot console," Hanslovan says.

But based on the timestamps, the Webroot console was used to download payloads onto all managed systems very quickly and possibly in an automated fashion. "This affected customer had 67 computers targeted by malicious PowerShell delivered by Webroot," Hanslovan says. "We're not sure how many computers were successfully encrypted by the ransomware."

What's also not clear is how the attackers are managing to gain access to the Webroot console so efficiently he says.  "We’ve yet to see anything that would suggest the issue is a global Webroot vulnerabilty." However, three MSP incidents in less than 48hrs involved compromised Webroot management console credentials, he notes.

One Reditt poster using the handle "Jimmybgood22" claimed Thursday afternoon that almost all of its systems were down. "One of our clients getting hit with ransomware is a nightmare, but all of our clients getting hit at the same time is on another level completely," Jimmybgood22 wrote.

Huntress Labs posted a copy of an email that Webroot purportedly sent out to customers following the incident, informing them about two-factor authentication (2FA) now being enforced on the remote management portal. The email noted that threat actors who might have been "thwarted with more consistent cyber hygiene" had impacted a small number of Webroot customers. The company immediately began working with the customers to remediate any impact.

Effective early morning June 20, Webroot also initiated an automated console logoff and implemented mandatory 2FA in the Webroot Management Console, the security vendor said.  Chad Bacher, sebior vice president of products at Webroot says the comapny's product has not been compronised. "We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we’ve encouraged customers to use the Webroot Management Console’s built-in 2FA for some time," Bacher says.

Meanwhile, another researcher with UBX Cloud, a firm that provides triage and consulting services to MSPs, claimed on Reditt to have knowledge that the attacker had leveraged a remote monitoring and management tool from Kaseya to deliver the ransomware.

"Kaseya was the only common touch point between the MSPs clients and it is obvious that the delivery method leveraged Kaseya's automation by dropping a batch file on the target machine and executing via agent procedure or PowerShell," the researcher claimed. As with the Webroot console, the MSP did not appear to have implemented 2FA for accessing the Kaseya console.

In emailed comments, John Durant, CTO at Kaseya, confirmed the incident."We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Durant says. "All available evidence at our disposal points to the use of compromised credentials."

In February, attackers pulled off an almost identical attack against another US-based MSP. In that incident, between 1,500 and 2,000 computers belonging to the MSP's customers were simultaneously encrypted with GandCrab ransomware. Then, as now, the attackers are believed to have used Kaseya's remote monitoring and management tool to distribute the malware.

MSPs and IT administrators continue to be targets for attackers looking to gain credentials for unauthorized access, Durant says. "We continue to urge customers to employ best practices around securing their credentials, regularly rotating passwords, and strengthening their security hygiene," he says.

Related Content:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Apprentice
1/2/2020 | 10:05:24 AM
I was worried about my MSP and made changes before it became a problem
I had my offices servers and applications at an MSP that had its own  data center, but the service and performance was terrible, and we had a feeling that security was simply not up to par with what we needed for HIPAA compliance and disaster recovery.  Our medical offices throughout New Jersey could not afford any downtime.   I met with several other vendors and finally found one that provided honest advice and recommendations.  Baroan Technologies really stood apart from the rest and migrated us to Microsoft Azure. This way we know that it is not up to a basic MSP like Synoptek anymore, but the servers are really in Azure.  I also like that I'm not in a vendor lock with any MSP.  I can transfer the Azure servers to the management of any company that I want.  Baroan handles everything for a fixed fee.  We have two factor  MFA with DUO and Microsoft for our email, our terminal server,  just about everything.   I got peace of mind, so I never have to think about a disaster like what happened with Synoptek and their customers.   I recommend that any business that has their servers at the private data center of any MSP should question why it is so.  Find an IT vendor like Baroan Technologies  that cares more about your business then just their own interests and take steps before there is a disaster.
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.