Kaseya

Overview

HackTool:Win32/Kaseya (or related detections) does not refer to the Kaseya VSA software itself as being inherently malicious, but rather flags the abuse of this legitimate IT management platform in one of the most significant **Supply Chain Attacks** in history. In 2021, the REvil (Sodinokibi) ransomware gang exploited zero-day vulnerabilities in the Kaseya VSA server infrastructure to automatically deploy ransomware to thousands of downstream Managed Service Provider (MSP) clients.

Understanding the Kaseya Supply Chain Attack
To an end-user, the infection appeared as a sudden, catastrophic ransomware encryption of their entire network. For security analysts, this represents the ultimate nightmare: a trusted, highly privileged administrative tool (`T1199`) being hijacked to distribute malware. Because Kaseya VSA agents inherently possess SYSTEM-level privileges on the endpoints they manage, the ransomware bypassed normal behavioral defenses.

Execution and Exploitation Mechanics
The attackers did not phish individual users. They exploited authentication bypass and command injection vulnerabilities on internet-facing Kaseya VSA servers (`T1190`). Once compromised, the attackers used the VSA server's legitimate software deployment capabilities to push a malicious update down to all connected endpoint agents (`T1199`). The payload consisted of a legitimate, older version of Microsoft Defender (`MsMpEng.exe`) vulnerable to DLL side-loading, and a malicious DLL (`mpsvc.dll`) containing the REvil ransomware encryptor (`T1574.002`). The VSA agent executed the legitimate Defender process, which side-loaded the ransomware, executing the encryption routine with SYSTEM privileges and disabling local defenses (`T1562.001`).

Indicators of Compromise & Impact
The impact was massive, simultaneous encryption of thousands of businesses globally. Host-based IoCs associated with this specific attack include the presence of `agent.crt` (the dropped payload) in the `c:\kworking\` directory (the default Kaseya working folder), the execution of `MsMpEng.exe` from an unusual location, and the side-loading of `mpsvc.dll`. Network IoCs were minimal during execution, as the payload was delivered via the trusted VSA encrypted channel.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_KASEYA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Kaseya"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "kaseya" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Kaseya (Ransomware) Execution & Triage
id: 820d51f3-d335-5b47-88a0-f3511f42cd02
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Kaseya malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/kaseya
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1574_002
- attack.t1199
- attack.t1486
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_KASEYA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Kaseya tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "kaseya" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. IMMEDIATELY sever all network connectivity to the Kaseya VSA server (or isolate the VSA agent endpoints) to prevent the distribution of further malicious payloads.
2. For endpoints already encrypted, isolate them to prevent lateral movement of the ransomware.
3. Apply all emergency patches provided by the software vendor (Kaseya) to the VSA infrastructure before bringing it back online.
4. Analyze the `c:\kworking\` directory and EDR telemetry on endpoints for signs of the DLL side-loading technique.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not blindly trust all processes executing from enterprise management tools; implement strict behavioral monitoring even for highly privileged applications.
2. Avoid exposing administrative management interfaces (like the VSA server web portal) directly to the public internet without strict IP whitelisting or VPN access requirements.

References & External Analysis

• CISA Advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362
• Search "kaseya" on VirusTotal (External Analysis)
• Search "kaseya" on Any.Run (Sandbox Sandbox)
• Search "kaseya" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362 ↗

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Datper
• Vopackage
• Genericrxfs
• Ngvck
• Cryfile
• Samas
• Mazben
• Rostpay

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/kaseya.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.