It affected fewer than 60 Kaseya VSA customers - but around 30 of them were MSPs, and the code was then sent on to their customers. Kaseya sends out updates to these VSA servers and, on Friday July 2, an update was distributed that contained REvil ransomware code. These SaaS VSA servers can be deployed by end-users or by MSPs. It is supplied either as a hosted cloud service by Kaseya, or via on-premises VSA servers. VSA, the Virtual System/Server Administrator, is software used by Kaseya customers to monitor and manage their infrastructure. Due to our teams’ fast response, we believe that this has been localised to a very small number of on-premises customers only.“ More affected customers identified.Ī Kaseya statement explained: “Kaseya’s VSA product has unfortunately been the victim of a sophisticated cyberattack. Updated numbers of affected customers added. Kaseya’s VSA remote monitoring and management tool was used as an attack vector to inject ransomware into the systems of fewer than 1,500 end-customers of some 30 managed service providers (MSPs) at the start of the USA’s Independence Day weekend.

Kaseya agent wiki