---
id: 905
title: "The Kaseya/REvil Attack Explained"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/the-kaseya-revil-attack-explained/"
published_at: "2021-07-07 00:00"
tags: ["supply-chain", "zero-day", "incident-response", "ransomware", "kaseya", "revil", "msp"]
phying_url: "https://phying.com/item/905"
lang: en
---

# The Kaseya/REvil Attack Explained

## Summary

Attackers used a zero-day auth bypass in internet-facing Kaseya VSA servers to push REvil ransomware to managed systems. Kaseya urged shutting VSA down and released a detection tool.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2021-07-07 00:00
- **Original:** https://www.bugcrowd.com/blog/the-kaseya-revil-attack-explained/
- **Phying News:** https://phying.com/item/905