Rewterz Threat Alert – Gamaredon APT – Active IOCs
July 5, 2021Rewterz Threat Alert – FormBook Malware – Active IOCs
July 5, 2021Rewterz Threat Alert – Gamaredon APT – Active IOCs
July 5, 2021Rewterz Threat Alert – FormBook Malware – Active IOCs
July 5, 2021Severity
High
Analysis Summary
On the Fourth of July weekend, around 200 organizations all over the world were hit with a ransomware attack. Investigators are calling this the “largest ransomware attack in history.” The REvil ransomware group exploited the Kaseya VSA tool used to perform client monitoring and patch management by MSPs. The gang initially compromised the VSA software, and then deployed their ransomware on the on-premise servers of enterprise networks.
This is an ongoing attack and more than 20 MSPs have been compromised as of yet. FBI is helping the company investigate this incident and organizations and vendors affected by the attack have also released advisories on patches and remediations for the attack. The initial ransomware demand was $44,999
Impact
- Credential Theft
- File Encryption
- Information Disclosure
- Data Breach
Affected Vendors
- Kaseya
Affected Products
- Kaseya VSA Servers
Indicators of Compromise
Domain Name
- ncuccr[.]org
- 1team[.]es
- 4net[.]guru
- 35-40konkatsu[.]net
- 123vrachi[.]ru
- 4youbeautysalon[.]com
- 12starhd[.]online
- 101gowrie[.]com
- 8449nohate[.]org
- 1kbk[.]com[.]ua
- 365questions[.]org
- 321play[.]com[.]hk
- candyhouseusa[.]com
- andersongilmour[.]co[.]uk
- facettenreich27[.]de
- blgr[.]be
- fannmedias[.]com
- southeasternacademyofprosthodontics[.]org
- filmstreamingvfcomplet[.]be
- smartypractice[.]com
- tanzschule-kieber[.]de
- iqbalscientific[.]com
- pasvenska[.]se
- cursosgratuitosnainternet[.]com
- bierensgebakkramen[.]nl
- c2e-poitiers[.]com
- gonzalezfornes[.]es
- tonelektro[.]nl
- milestoneshows[.]com
- blossombeyond50[.]com
- thomasvicino[.]com
- kaotikkustomz[.]com
- mindpackstudios[.]com
- faroairporttransfers[.]net
- daklesa[.]de
- bxdf[.]info
- simoneblum[.]de
- gmto[.]fr
- cerebralforce[.]net
- myhostcloud[.]com
- fotoscondron[.]com
- sw1m[.]ru
- homng[.]net
MD5
- 561cffbaba71a6e8cc1cdceda990ead4
- a47cf00aedf769d60d58bfe00c0b5421
SHA-256
- d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e
- 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd
SHA1
- 5162f14d75e96edb914d1756349d6e11583db0b0
- 656c4d285ea518d90c1b669b79af475db31e30b1
Remediation
- Block all threat indicators at your respective controls.
- This tool analyzes a system (either VSA server or managed endpoint) and discovers whether any (IoC) are
- present. Download the Kaseya VSA Detection Tool.
- Search for IOCs in your environment.