Software Firm's Unveiling of Decryption Key Comes too Late for Many Victims of Devastating Ransomware Attack

An American software company, Kaseya announced that it could help unlock any of its customers' systems that were still inaccessible following a devastating ransomware attack early this month that took down as many as 1,500 businesses worldwide. But for many victims it was too little, too late.

Kaseya had obtained a decryption key, the company said, that could release any file still locked down by malicious software produced by the criminal gang REvil, which is believed to operate from Eastern Europe or Russia.

For the organizations whose systems were still offline three weeks after the attack, the newfound availability of a decryptor tool offered a sign of hope, especially after REvil mysteriously disappeared from the internet and left many organizations unable to contact the group.

But for many others that have already recovered without Kaseya's help, either by paying off the ransomware gang weeks ago or by painstakingly restoring from backups, the announcement was no help -- and opens a new chapter of scrutiny for Kaseya as it declines to answer questions about how it obtained the key and whether it paid the $70 million ransom demand or another amount.

Read more ...

July 25, 2021