Kaseya Update - Cryptocurrency Mining Campaign

eSentire has observed recent threat activity attributed to an active crypto-currency mining campaign leveraging Kaseya’s Virtual System Administrator (VSA). eSentire has worked with Kaseya to share details of this threat. On 2018-02-16, Kaseya released critical patches for their VSA product in addition to updated remediation actions for impacted customers [1]. eSentire recommends impacted customers review and deploy security updates contained in the advisory as soon as possible.

What we’re doing about

• Associated IP addresses have been added to the eSentire Global Blacklist.
• Detections have been deployed on esENDPOINT^TM and esNETWORK^TM.
• The Threat Intelligence Team is monitoring this incident for further information.

What you should do about it

• Customers who currently have Kasaya’s Virtual System Administrator (VSA) deployed in their environment should review the latest advisory from Kaseya [1]. This advisory contains new patches and guidance, which eSentire recommends customers with VSA action on as soon as possible.
• In circumstances where Kaseya VSA is deployed, but managed by a 3^rd party service provider, we recommend following up with this provider to ensure Kaseya’s advisory has been received and is being actioned upon.

Additional information

eSentire originally notified customers about an active cryptocurrency-mining campaign leveraging Kaseya VSA on 2018-01-29 [2]. Kaseya released patches for their VSA product which addressed the threat at the time.

Over the last several weeks, eSentire responded to multiple incidents across our customers which we attributed to the same cryptocurrency-mining campaign. In each incident, eSentire worked with our customers to identify and contain the threat. During this period, we provided Kaseya with updated information pertaining to the threat. Additionally, we updated our original advisory with new information.

On 2018-02-16, Kaseya updated their original URL with new guidance for their VSA customers [1]. This includes patches, identification scripts, and remediation actions. eSentire recommends impacted customers to review Kaseya’s guidance on this matter and apply the latest patches as soon as possible. We are also recommending customers rotate passwords for their VSA product post-patch and implement two-factor authentication.

[1] https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152-Q1-2018-VSA-Security-Update

[2] https://www.esentire.com/news-and-events/security-advisories/kaseya-virtual-system-administrator/