Kaseya gets master decryption key after July 4 global attack

By FRANK BAJAK
AP Technology Writer

BOSTON (AP) — The Florida company whose software was exploited in the devastating Fourth of July weekend ransomware attack, Kaseya, has received a universal key that will decrypt all of the more than 1,000 businesses and public organizations crippled in the global incident.

Kaseya spokeswoman Dana Liedholm would not say Thursday how the key was obtained or whether a ransom was paid. She said only that it came from a “trusted third party” and that Kaseya was distributing it to all victims. The cybersecurity firm Emsisoft confirmed that the key worked and was providing support.

Ransomware analysts offered multiple possible explanations for why the master key, which can unlock the scrambled data of all the attack’s victims, has now appeared. They include: Kaseya paid; a government paid; a number of victims pooled funds; the Kremlin seized the key from the criminals and handed it over through intermediaries — or perhaps the main attacker didn’t get paid by the gang whose ransomware was used.

The Russia-linked criminal syndicate that supplied the malware, REvil, disappeared from the internet on July 13. That likely deprived whoever carried out the attack of income because such affiliates split ransoms with the syndicates that lease them the ransomware. In the Kaseya attack, the syndicate was believed overwhelmed by more ransom negotiations than it could manage, and decided to ask $50 million to $70 million for a master key that would unlock all infections.

By now, many victims will have rebuilt their networks or restored them from backups.

It’s a mixed bag, Liedholm said, because some “have been in complete lockdown.” She had no estimate of the cost of the damage and would not comment on whether any lawsuits may have been filed against Kaseya. It is not clear how many victims may have paid ransoms before REvil went dark.

The so-called supply-chain attack of Kaseya was the worst ransomware attack to date because it spread through software that companies known as managed service providers use to administer multiple customer networks, delivering software updates and security patches.

President Joe Biden called his Russian counterpart, Vladimir Putin, afterward to press him to stop providing safe haven for cybercriminals whose costly attacks the U.S. government deems a national security threat. He has threatened to make Russia pay a price for failing to crack down, but has not specified what measures the U.S. may take.

If the universal decryptor for the Kaseya attack was turned over without payment, it would not be the first time ransomware criminals have done that. It happened after the Conti gang hobbled Ireland’s national health care service in May and the Russian Embassy in Dublin offered “to help with the investigation.”

SportsPlus

Local News

UPDATE: Four of five candidates for superintendent already work for CPSB

Local News

Calcasieu Parish’s Galan touts progress with drainage projects

Crime

Inmate inadvertently released from custody back in handcuffs

Local News

Three new fire trucks on the way for DeRidder Fire Department

Local News

Iowa approves operating budget, reallocates some sales taxes

Crime

6/26: Calcasieu Parish Sheriff announces arrest list

Local News

Westlake approves plan to allow golf carts on streets

Crime

Four accused in theft ring at Academy stores

Local News

Supreme Court rules for Biden administration in social media dispute

Crime

WikiLeaks founder Julian Assange returns to Australia a free man after US legal battle ends

Business

Process Service Specialists announce $3.5M expansion into SW La.

Local News

Poll: Most Americans plan to watch the Biden-Trump debate — and many see high stakes

Jim Beam

Jim Beam column:How about the 10 Bill of Rights?

Local News

Superintendent search narrowed down to five

Local News

American Job Center, Louisiana Workforce Commission to host job fair July 10

Local News

Family & Youth award Youth, Humanitarian of the Year honors

Local News

Cassidy meets with realtors on flood insurance

Crime

6/25: Calcasieu Parish Sheriff announces arrest list

Local News

ROADWORK UPDATE: US 165, I-10 closures planned

Crime

Julian Assange leaves jail on his way to enter plea deal with US

Local News

Local leaders concerned as standards for La. schools change

Local News

Sharing the knowledge: LC recovery story will be recounted at summit

Local News

Paying tribute to their own: Residents honor area Vietnam veterans

Local News

PHOTO GALLERY: Vietnam veterans honored