On 2 July 2021, the Friday before a holiday weekend, REvil pushed a malicious update through Kaseya VSA — the remote-management software trusted by managed service providers to administer thousands of client networks. Roughly 60 MSPs and up to 1,500 of their downstream businesses were encrypted in a single coordinated stroke: the single largest ransomware supply-chain attack ever executed. The attackers demanded $70 million for a universal decryptor — then vanished offline days later, before most victims paid anything. Kaseya’s sobering aftermath became case law for MSP supply-chain risk, and the event’s reverberations reached the White House directly.
REvil attackers compromised Kaseya VSA servers (the on-premises remote monitoring and management platform MSPs use to push software and scripts to clients), weaponised the platform’s own update mechanism, and pushed a malicious “Microsoft Defender update” package that detonated ransomware on every endpoint the server managed — with the tell-tale defender.md noteto “not touch” Latin-American machines (a politically motivated avoidance of US-LatAm diplomatic posts’ networks, per later reporting). ~60 MSPs and ~800–1,500 downstream businesses were hit; supermarkets in Sweden (Coop, 800 stores closed), schools in New Zealand, and pharmacies offline. REvil demanded $70M for a universal decryptor; individual demands ranged ~$45k targeted low to $5M+. The attack chain: authentication bypass in VSA (CVE-2021-30116 credentials leak) → admin → malicious update job → ransomware. Kaseya took VSA servers to SaaS-mode emergency patch; REvil infrastructure went dark ~13 July (widely attributed to Kremlin pressure after Biden-Putin escalation), and most victims restored without paying — but the structural risk (MSP as single point of mass compromise) shipped permanent changes to the industry.
What happened
The attack unfolded in hours. On 2 July 2021 (July 3 EU timezone), REvil-affiliated operators exploited vulnerabilities in Kaseya VSA — primarily an authentication-bypass/credential-disclosure chain (CVE-2021-30116 et al., known privately before public disclosure and used precisely in the window before customers could patch) — to gain administrator access to on-prem VSA servers. From inside the management plane, they created a rogue “software update” job: a signed-looking installer payload that dropped the ransomware, disabled protections, and encrypted machines under each MSP’s management. Because VSA agents run with high privileges on every client endpoint, the malicious “update” inherited total trust — the perfect supply-chain detonator.
The impact map was dizzying for its diversity: Sweden’s Coop grocery chain closed ~800 stores (tills and logistics down via a Danish MSP — also the outage’s most-visible consumer symptom), New Zealand schools, a German IT provider, hundreds of SMBs across a dozen-plus countries. The FCC demanded briefings; the White House cybersecurity shop (Neuberger/Inglis following the June summit’s red-lines pledge) escalated directly to the Kremlin. Then, on 13 July, REvil’s infrastructure wholesale disappeared — Happy Blog leak site, payment portals, negotiator channels all offline — coincident with (unofficially-attributed) Kremlin action; the gang partially resurfaced (September-botched relaunch, October real takedown by Russian FSB after US pressure, arrests + REvil actors charged; the universal decryptor obtained/shared by researchers helped some victims).
Research by the Dutch Institute for Vulnerability Disclosure (DIVD) added a remarkable epilogue: DIVD had been coordinating with Kaseya to patch the very vulnerabilities used, and the attackers jumped the coordinated-disclosure window — striking days before customers could logically have patched. The case thus teaches both attacker economics (exploit the disclosure gap itself) and the urgency of vendor-partner rapid-patch paths.
How it worked
The chain, from entrance to mass encryption:
(1) initial access: auth bypass/credential leak in Kaseya VSA
on-prem server (CVE-2021-30116 class; pre-patch window)
(2) management-plane takeover: attacker = VSA admin
- can push ANY package to ALL managed endpoints
(3) weaponised update job: "Microsoft Defender update"
- drops ransomware (REvil affiliate build)
- kills defender/admin tools pre-encryption
- excludes Latin America per political note (defender.md)
(4) mass detonation: every endpoint under MSP management
encrypts within hours; ~60 MSPs, ~800-1500 businesses
(5) extortion: universal decryptor $70M demand;
per-victim demands up to ~$5M
(6) aftermath: VSA SaaS emergency-patched; REvil infra
goes dark 2021-07-13 (Kremlin pressure attribution);
most victims restore without paying - and the October
FSB takedown + arrests followThe architectural lesson is stark: a management platform with total endpoint trust is a domain controller by another name. Once the attacker owns the management plane, agent-side defences are irrelevant — the “update” arrives with the highest possible authority. MSP hardening doctrine after Kaseya: management-plane MFA everywhere, IP allow-listing admin paths, egress segmentation between client tenants, and (controversially) blast-radius caps — limiting how many endpoints one server can simultaneously command, the supply-chain equivalent of circuit breakers. These controls carry forward into modern guidance for any privileged-management tooling, the same discipline our software supply-chain guide formalises.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Attack date | 2021-07-02 (Friday before July 4 weekend) | Kaseya/DIVD timeline |
| Direct MSP victims | ~60 MSPs | Kaseya statements/press |
| Downstream businesses | ~800–1,500 | Kaseya/ENISA/press estimates |
| Visible consumer impact | Coop Sweden ~800 stores closed; NZ schools; DE IT provider | press reporting |
| Ransom demand | $70M universal decryptor | REvil leak-site post |
| Exploited flaw | VSA pre-auth credential leak chain (CVE-2021-30116 et al.) | Kaseya advisory/DIVD |
| REvil offline | 2021-07-13 infrastructure vanished (Kremlin pressure attribution) | press/researcher consensus |
| Endpoints encrypted | Low hundreds of thousands (global estimates) | firm telemetry |
Timeline
| Date | Event |
|---|---|
| 2021-07-02 | REvil pushes malicious VSA update; mass encryption within hours |
| 2021-07-03/05 | Kaseya emergency-shuts down VSA SaaS; incident war-room; $70M demand posted |
| 2021-07-11 | Patch released for on-prem VSA vulnerabilities |
| 2021-07-13 | REvil infrastructure disappears |
| 2021-08–09 | Victims restore; botched REvil relaunch attempt |
| 2021-10 | FSB arrests REvil members; takedown confirmed |
Why it still matters in 2026
Kaseya defined the MSP supply-chain attack: not a single company breached, but a force multiplier turning one entry into a thousand encrypted networks. Its direct descendants are everywhere — the 2022 Okta/MSP channel compromises, ransomware crews specialising in RMM tool abuse (GoTo/ITarian/ScreenConnect waves), 2023–2025 attacks on file-transfer platforms (MOVEit, Cleo) replaying the same multiplier logic with exfiltration instead of encryption. Regulatory lineage is equally direct: MSP-focused guidance (CISA/NSA hardening advisories), cyber-insurance subrogation fights over MSP negligence, and statutory notification cascades where one vendor incident triggers thousands of downstream filers. The original operational lesson scales: whatever manages many machines is an attack multiplier deserving tier-0 protection — a principle we expand for modern stacks in software supply-chain analysis and ransomware-economy retrospectives.
Detection and hardening takeaways
- Harden management planes like domain controllers. RMM/VSA/SCCM/Intune admin paths require MFA (phishing-resistant), IP allow-listing, dedicated admin accounts, and full audit alerting — REvil owned the plane first and everything downstream inherited that compromise.
- Cap the blast radius. Segment clients/tenants so one management server can’t command the entire estate; split critical infrastructure onto separate management stacks. One VSA-server-per-vertical is cheaper than one incident-per-everything.
- Watch update-push telemetry. Alert on out-of-band update jobs, unusual push timing (holiday weekends!), unsigned or hastily-changed packages, and disable auto-execution of vendor signed-script mechanisms where possible — the malicious job looked routine; timing and scope were the anomalies.
- Patch management platforms FIRST. The tools that patch everything else are the highest-value targets; treat their advisories as out-of-band priority, and timeline-check coordinated disclosures (DIVD-Kaseya gap was days, used precisely).
- Rehearse offline-operations mode. Coop’s 800-store closure was a tills-and-logistics failure, not a data disaster; retail/healthcare/manufacturing need tested manual-fallback procedures for when management tooling is the casualty.
FAQ
Did anyone pay the $70 million?
No universal-decryptor payment was ever confirmed. Individual victims faced demands from tens of thousands to millions; some reportedly paid, but REvil’s 13 July disappearance froze negotiations before mass payment — and the bootleg decryptor shared afterwards (obtained by a researcher) plus backups restored most victims. The gang’s October takedown eliminated the follow-up extortion cycle entirely.
Why did REvil disappear in July?
Never officially explained, but universally attributed to Kremlin pressure following the direct US escalation over Kaseya (the June red-lines pledge had named critical infrastructure; Kaseya’s downstream reach crossed that bar). The partial September relaunch failed, and the October FSB arrests — coordinated after renewed US pressure — closed the chapter.
Could this happen to a modern RMM today?
The multiplier logic persists but the defences matured: SaaS RMM platforms patched intra-day, management-plane MFA defaults, tenant isolation, and signed update chains raise the bar. Yet MOVEit (2023) proved mass-supply-chain compromise remains fully viable — the modern variant exfiltrates rather than encrypts. Treat any platform with privileged reach across many organisations as a standing national-security-scale risk, because attackers demonstrably do.
