It is now being called the single-biggest Ransomware attack recorded, with 1000s of victims in at least 17 different countries breached with Ransomware on Friday last week.

An affiliate of the Russia-linked gang REvil deployed the ransomware “largely through firms that remotely manage IT infrastructure for multiple customers.”

A broad array of businesses and public agencies were hit by the latest attack, apparently on all continents, including in financial services, travel and leisure and the public sector — though few large companies, the cybersecurity firm Sophos reported… The Swedish grocery chain Coop said most of its 800 stores would be closed for a second day Sunday because their cash register software supplier was crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT were also hit. In Germany, an unnamed IT services company told authorities several thousand of its customers were compromised, the news agency dpa reported…

CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like “dental practices, architecture firms, plastic surgery centers, libraries, things like that.” Voccola said in an interview that only between 50-60 of the company’s 37,000 customers were compromised. But 70% were managed service providers who use the company’s hacked VSA software to manage multiple customers. It automates the installation of software and security updates and manages backups and other vital tasks…

Dutch researchers said they alerted Miami-based Kaseya to the breach and said the criminals used a “zero day,” the industry term for a previously unknown security hole in software. Voccola would not confirm that or offer details of the breach — except to say that it was not phishing. “The level of sophistication here was extraordinary,” he said. When the cybersecurity firm Mandiant finishes its investigation, Voccola said he is confident it will show that the criminals didn’t just violate Kaseya code in breaking into his network but also exploited vulnerabilities in third-party software…

Kaseya, which called on customers Friday to shut down their VSA servers immediately, said Sunday it hoped to have a patch in the next few days.

The attacks may have been timed to exploit America’s three-day weekend celebrating the nation’s founding, according to experts interviewed by the Associated Press. America’s National Security advisor is now urging all who believed they were compromised to alert the FBI.

“The attack comes less than a month after Biden pressed Russian President Vladimir Putin to stop providing safe haven to REvil and other ransomware gangs whose unrelenting extortionary attacks the U.S deems a national security threat.”

In a statement yesterday, DIVD posted that “During the last 48 hours, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2,200 to less than 140 in our last scan today. A very good demonstration of how a cooperative network of security-minded organisations scan be very effective during a nasty crisis.”

Credit to Slashdot. Full article can be found on the following URL https://it.slashdot.org/story/21/07/05/0210241/worlds-single-biggest-ransomware-attack-hit-thousands-in-17-countries