Kaseya gets master decryption key after July 4 global attack

Jul 22, 2021, 12:44 PM | Updated: Jul 27, 2021, 12:54 pm
FILE - In this July 3, 2021, file photo, a sign that reads: "Coop Forum supermarket in Vastberga is...

FILE - In this July 3, 2021, file photo, a sign that reads: "Coop Forum supermarket in Vastberga is closed due to IT disturbances, no prognosis as to when we will open again", on a closed Coop supermarket store in the suburb of Vastberga, Stockholm, Sweden. The Florida company whose software was exploited in the devastating Fourth of July weekend ransomware attack, Kaseya, has received a universal key that will decrypt all of the more than 1,000 businesses and public organizations crippled in the global incident. Kaseya spokeswoman Dana Liedholm would not say Thursday, July 22, how the key was obtained or whether a ransom was paid. She said only that it came from a “trusted third party” and that Kaseya was distributing it to all victims. (Jonas Ekstromer/TT via AP, File)

(Jonas Ekstromer/TT via AP, File)

BOSTON (AP) — The Florida company whose software was exploited in the devastating Fourth of July weekend ransomware attack, Kaseya, has received a universal key that will decrypt all of the more than 1,000 businesses and public organizations crippled in the global incident.

Kaseya spokeswoman Dana Liedholm would not say Thursday how the key was obtained or whether a ransom was paid. She said only that it came from a “trusted third party” and that Kaseya was distributing it to all victims. The cybersecurity firm Emsisoft confirmed that the key worked and was providing support.

Ransomware analysts offered multiple possible explanations for why the master key, which can unlock the scrambled data of all the attack’s victims, has now appeared. They include: Kaseya paid; a government paid; a number of victims pooled funds; the Kremlin seized the key from the criminals and handed it over through intermediaries — or perhaps the main attacker didn’t get paid by the gang whose ransomware was used.

The Russia-linked criminal syndicate that supplied the malware, REvil, disappeared from the internet on July 13. That likely deprived whoever carried out the attack of income because such affiliates split ransoms with the syndicates that lease them the ransomware. In the Kaseya attack, the syndicate was believed overwhelmed by more ransom negotiations than it could manage, and decided to ask $50 million to $70 million for a master key that would unlock all infections.

By now, many victims will have rebuilt their networks or restored them from backups.

It’s a mixed bag, Liedholm said, because some “have been in complete lockdown.” She had no estimate of the cost of the damage and would not comment on whether any lawsuits may have been filed against Kaseya. It is not clear how many victims may have paid ransoms before REvil went dark.

The so-called supply-chain attack of Kaseya was the worst ransomware attack to date because it spread through software that companies known as managed service providers use to administer multiple customer networks, delivering software updates and security patches.

President Joe Biden called his Russian counterpart, Vladimir Putin, afterward to press him to stop providing safe haven for cybercriminals whose costly attacks the U.S. government deems a national security threat. He has threatened to make Russia pay a price for failing to crack down, but has not specified what measures the U.S. may take.

If the universal decryptor for the Kaseya attack was turned over without payment, it would not be the first time ransomware criminals have done that. It happened after the Conti gang hobbled Ireland’s national health care service in May and the Russian Embassy in Dublin offered “to help with the investigation.”

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

A person stands near an electronic stock board showing Japan's Nikkei 225 index at a securities fir...
Associated Press

Asian shares mostly lower as recession fears deepen

BANGKOK (AP) — Asian shares were mostly lower on Monday after Wall Street closed out a miserable September with a loss of 9.3%, the worst monthly decline since March 2020. Tokyo rose while other regional markets declined. Shanghai was closed for China’s weeklong National Day holidays. Japan’s Nikkei 225 index gained 0.6% to 26,100.68 after […]
23 hours ago
Associated Press

It’s flu vaccine time and seniors need revved-up shots

Doctors have a message for vaccine-weary Americans: Don’t skip your flu shot this fall — and seniors, ask for a special extra-strength kind. After flu hit historically low levels during the COVID-19 pandemic, it may be poised for a comeback. The main clue: A nasty flu season just ended in Australia. While there’s no way […]
23 hours ago
Associated Press

It’s flu vaccine time and seniors need revved-up shots

Doctors have a message for vaccine-weary Americans: Don’t skip your flu shot this fall — and seniors, ask for a special extra-strength kind. After flu hit historically low levels during the COVID-19 pandemic, it may be poised for a comeback. The main clue: A nasty flu season just ended in Australia. While there’s no way […]
23 hours ago
Marines from Philippines, Japan, South Korea and the United States carry their flag during opening ...
Associated Press

US, Philippine forces hold combat drills to brace for crisis

MANILA, Philippines (AP) — More than 2,500 U.S. and Philippine marines joined combat exercises Monday to be able to respond to any sudden crisis in a region long on tenterhooks over South China Sea territorial disputes and increasing tensions over Taiwan. The annual military drills are some of the largest so far between the longtime […]
23 hours ago
Marines from Philippines, Japan, South Korea and the United States carry their flag during opening ...
Associated Press

US, Philippine forces hold combat drills to brace for crisis

MANILA, Philippines (AP) — More than 2,500 U.S. and Philippine marines joined combat exercises Monday to be able to respond to any sudden crisis in a region long on tenterhooks over South China Sea territorial disputes and increasing tensions over Taiwan. The annual military drills are some of the largest so far between the longtime […]
23 hours ago
Chimneys and a tank are pictured at the BASF chemical plant in Ludwigshafen, Germany, Tuesday, Sept...
Associated Press

Europe faces ‘unprecedented risk’ of gas shortage, IEA says

Europe faces “unprecedented risks” to its natural gas supplies this winter after Russia cut off most pipeline shipments and could wind up competing with Asia for already scarce and expensive liquid gas that comes by ship, the International Energy Agency said. The Paris-based IEA said in its quarterly gas report released Monday that European Union […]
23 hours ago

Sponsored Articles

...
Quantum Fiber

How high-speed fiber internet can improve everyday life

Quantum Fiber supplies unlimited data with speeds up to 940 mbps, enough to share 4K videos with coworkers 20 times faster than a cable.
...
Sanderson Ford

Don’t let rising fuel prices stop you from traveling Arizona this summer

There's no better time to get out on the open road and see what the beautiful state of Arizona has to offer. But if the cost of gas is putting a cloud over your summer vacation plans, let Sanderson Ford help with their wide-range selection of electric vehicles.
...
Dr. Richard Carmona

Great news: Children under 5 can now get COVID-19 vaccine

After more than two years of battle with an invisible killer, we can now vaccinate the youngest among us against COVID-19. This is great news.
Kaseya gets master decryption key after July 4 global attack