CENTRAL LAKE (Michigan), July 4 (NNN-AGENCIES) — A ransomware attack on a US IT company potentially targeted 1,000 businesses, researchers said, with one of Sweden’s biggest supermarket chains revealing it had to temporarily close around 800 stores after losing access to its checkouts.
Kaseya said Friday evening it had limited the attack to “a very small percentage of our customers” who use its signature VSA software – “currently estimated at fewer than 40 worldwide.”
But cybersecurity firm Huntress Labs said in a Reddit forum that it was working with partners targeted in the attack, and that the software was manipulated “to encrypt more than 1,000 companies.”
The impacted businesses had files encrypted and were left electronic messages asking for ransom payments of thousands or millions of dollars.
President Joe Biden said on Saturday he has directed US intelligence agencies to investigate who was behind the attack.
Huntress Labs said on Friday it believed the Russia-linked REvil ransomware gang was to blame for the latest ransomware outbreak. Last month, the FBI blamed the same group for paralysing meat packer JBS.
Biden, on a visit to Michigan to promote his vaccination programme, was asked about the hack while shopping for pies at a cherry orchard market.
Biden said “we’re not certain” who is behind the attack. “The initial thinking was it was not the Russian government but we’re not sure yet,” he said.
Biden said he had directed US intelligence agencies to investigate, and the United States will respond if they determine Russia is to blame.
During a summit in Geneva on June 16, Biden urged Russian President Vladimir Putin to crack down on cyber hackers emanating from Russia, and warned of consequences if such ransomware attacks continued to proliferate.
Biden said he would receive a briefing about the latest attack on Sunday.
“If it is either with the knowledge of and/or a consequence of Russia then I told Putin we will respond,” Biden said, referring to what he told Putin in Geneva.
The hackers who struck on Friday hijacked widely used technology management software from a Miami-based supplier called Kaseya. They changed a Kaseya tool called VSA, used by companies that manage technology at smaller businesses. They then encrypted the files of those providers’ customers simultaneously.
Huntress said it was tracking eight managed service providers that had been used to infect some 200 clients.
Kaseya said on its own website on Friday that it was investigating a “potential attack” on VSA, which is used by IT professionals to manage servers, desktops, network devices and printers.
“This is a colossal and devastating supply chain attack,” Huntress senior security researcher John Hammond said in an email, referring to an increasingly high profile hacker technique of hijacking one piece of software to compromise hundreds or thousands of users at a time.
In a statement on Friday, the US Cybersecurity and Infrastructure Security Agency said it was “taking action to understand and address the recent supply-chain ransomware attack” against Kaseya’s VSA product.
According to Coop, one of Sweden’s biggest grocery chains, a tool used to remotely update its checkout tills was affected by the attack, so payments could not be taken.
“We have been troubleshooting and restoring all night, but have communicated that we will need to keep the stores closed today,” Coop spokesperson Therese Knapp told Swedish Television.
The Swedish news agency TT said Kaseya technology was used by the Swedish company Visma Esscom, which manages servers and devices for a number of Swedish businesses.
State railways services and a pharmacy chain also suffered disruption.
“They have been hit in various degrees,” Visma Esscom chief executive Fabian Mogren told TT.
Defence Minister Peter Hultqvist told Swedish television the attack was “very dangerous” and showed how business and state agencies needed to improve their preparedness.
“In a different geopolitical situation, it may be government actors who attack us in this way in order to shut down society and create chaos,” he said.
Supply chain attacks have crept to the top of the cybersecurity agenda after the United States accused hackers of operating at the Russian government’s direction and tampering with a network monitoring tool built by Texas software firm SolarWinds.
On Thursday, US and British authorities said Russian spies accused of interfering in the 2016 US presidential election have spent much of the past two years abusing virtual private networks (VPNs) to target hundreds of organisations worldwide.
On Friday, Russia’s embassy in Washington denied that charge.
