Joe Biden said on Saturday he had directed US intelligence agencies to investigate a sophisticated ransomware attack that hit hundreds of American businesses as the Fourth of July holiday weekend began and aroused suspicions of Russian gang involvement.
Huntress, a security company, said on Friday it believed the Russia-linked REvil ransomware gang was to blame. Last month, the FBI blamed the same group for paralyzing the meat packer JBS.
Active since April 2019, REvil develops network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms. JBS, a Brazil-based meat company, said it had paid the equivalent of an $11m ransom, escalating calls by US law enforcement to bring such groups to justice.
On a visit to Michigan, Biden was asked about the hack while shopping for pies at a cherry orchard. The president said “we’re not certain” who is behind the attack.
“The initial thinking was it was not the Russian government but we’re not sure yet,” he said.
Biden said he had directed US intelligence agencies to investigate, and the US would respond if it determined Russia was to blame. At a summit in Geneva on 16 June, Biden urged Vladimir Putin to crack down on hackers from Russia and warned of consequences if ransomware attacks continued.
The hackers who struck on Friday hijacked widely used technology management software from a supplier, Kaseya, that has headquarters in Dublin and Miami. They changed a tool called VSA, used by companies that manage technology at smaller businesses, then encrypted the files of those providers’ customers.
Kaseya said it was investigating a “potential attack” on VSA, which is used by IT professionals to manage servers, desktops, network devices and printers. Huntress said it was tracking eight managed service providers that had been used to infect about 200 clients.
The effects were felt internationally. In Sweden, most of the grocery chain Coop’s 800 stores were unable to open because cash registers weren’t working, according to the public broadcaster. State railways and a major pharmacy chain were also affected.
“This is a colossal and devastating supply chain attack,” said John Hammond, Huntress senior security researcher, referring to an increasingly high-profile technique of hijacking one piece of software to compromise hundreds or thousands of users.
Kaseya’s chief executive, Fred Voccola, said the company believed it had identified the source of the vulnerability and would “release that patch as quickly as possible to get our customers back up and running”.
Voccola said fewer than 40 Kaseya customers were known to be affected, but the ransomware could be affecting hundreds of companies that rely on Kaseya clients.
Voccola said the problem was only affecting “on-premise” customers, organizations running their own data centers. It was not affecting cloud-based services running software for customers, though Kaseya had shut down those servers as a precaution, he said.
The company said “customers who experienced ransomware and receive a communication from the attackers should not click on any links – they may be weaponised”.
A Gartner analyst, Katell Thielemann, said it was clear Kaseya “reacted with an abundance of caution. But the reality of this event is it was architected for maximum impact, combining a supply chain attack with a ransomware attack.”
Complicating the response was that the attack happened at the start of a major holiday in the US, when most corporate IT teams are not fully staffed. That could leave organizations unable to address other security vulnerabilities such as a dangerous Microsoft bug affecting software for print jobs, said James Shank, a threat intelligence analyst.
“Customers of Kaseya are in the worst possible situation,” Shank said. “They’re racing against time to get the updates out on other critical bugs.”
Shank said “it’s reasonable to think that the timing was planned” for the holiday.
The US Cybersecurity and Infrastructure Security Agency (Cisa) said it was “taking action to understand and address the recent supply-chain ransomware attack”. Such attacks have crept to the top of the cybersecurity agenda after the US accused hackers of operating at the Russian government’s direction and tampering with a network monitoring tool built by a Texas software company, SolarWinds.
On Thursday, US and British authorities said Russian spies accused of interfering in the 2016 US election had spent much of the past two years abusing virtual private networks (VPNs) to target organizations worldwide. Russia’s embassy in Washington denied the charge.