KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2021-30116
Kaseya · VSA
Zero-day credential leak and remote command injection flaw abused by REvil / Sodinokibi to encrypt over 1,500 downstream businesses.
Correlated Federal Court Cases & Exploitation Context (1)
Docket 3:21-cr-00314 · U.S. District Court for the Northern District of Texas
U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware) Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.
Exploitation Ground Zero: Adversary initial penetration targeted internet-facing infrastructure by weaponizing known security vulnerabilities (CVE-2021-30116, CVE-2021-30117, CVE-2021-30118), subsequently leveraging administrative tooling to compromise victim Managed Service Providers, Information Technology, Retail, Education systems.
Operational Impact: Resulted in $70,000,000 in documented financial liabilities. Extortion demands totaled $70 million for universal decryptor; extensive operational stoppage across schools, grocery stores, and local governments.
Sector: Managed Service Providers, Information Technology, Retail, Education · Loss: $70.0 million
Inspect Full Case Dossier →
Associated Government Advisories
- AA21-188A CISA Alert →