Kaseya

In July 2021, Kaseya, a multinational information technology software company, became a victim of a ransomware attack orchestrated by Yaroslav Vasinskyi, a Ukrainian national. This attack was part of a larger series of ransomware deployments associated with the Sodinokibi/REvil group. The attackers exploited vulnerabilities within Kaseya's software to deploy malicious code, leading to the encryption of data across Kaseya customer networks worldwide. Victims were left with ransom notes demanding payment for decryption keys, with the threat of their data being sold or leaked if they failed to comply. This incident not only caused significant operational disruption for Kaseya and its global clientele but also highlighted the pervasive threats faced by IT infrastructure and data security in the cyber domain.

Source: https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya

TPRM report: https://scoringcyber.rankiteo.com/company/kaseya

"id": "kas505050724",
"linkid": "kaseya",
"type": "Ransomware",
"date": "10/2021",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': ['Global clientele'],
                        'industry': 'Information Technology',
                        'name': 'Kaseya',
                        'type': 'Multinational IT Software Company'}],
 'attack_vector': "Exploiting vulnerabilities within Kaseya's software",
 'date_detected': 'July 2021',
 'description': 'In July 2021, Kaseya, a multinational information technology '
                'software company, became a victim of a ransomware attack '
                'orchestrated by Yaroslav Vasinskyi, a Ukrainian national. '
                'This attack was part of a larger series of ransomware '
                'deployments associated with the Sodinokibi/REvil group. The '
                "attackers exploited vulnerabilities within Kaseya's software "
                'to deploy malicious code, leading to the encryption of data '
                'across Kaseya customer networks worldwide. Victims were left '
                'with ransom notes demanding payment for decryption keys, with '
                'the threat of their data being sold or leaked if they failed '
                'to comply. This incident not only caused significant '
                'operational disruption for Kaseya and its global clientele '
                'but also highlighted the pervasive threats faced by IT '
                'infrastructure and data security in the cyber domain.',
 'impact': {'data_compromised': ['Customer data'],
            'operational_impact': 'Significant operational disruption',
            'systems_affected': ['Kaseya customer networks worldwide']},
 'initial_access_broker': {'entry_point': 'Exploiting vulnerabilities within '
                                          "Kaseya's software"},
 'motivation': 'Financial gain',
 'ransomware': {'data_encryption': ['Data across Kaseya customer networks '
                                    'worldwide'],
                'ransomware_strain': 'Sodinokibi/REvil'},
 'threat_actor': 'Yaroslav Vasinskyi',
 'title': 'Kaseya Ransomware Attack',
 'type': 'Ransomware Attack'}