Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

Kaseya VSA supply chain ransomware incident impacts managed service providers

In July 2021, attackers exploited Kaseya VSA and leveraged its remote management capabilities to distribute ransomware to downstream customers, particularly through managed service providers (MSPs). CISA issued alerts and guidance during the incident response period, and public vulnerability records tracked the relevant Kaseya VSA weakness used in the campaign. The event illustrates how compromise of a widely deployed management platform can multiply financial and operational impact across many organizations.
First reported July 2, 2021Supply Chainmed overall confidence
Incident library
First reportedJuly 2, 2021
ActivityJuly 2, 2021
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencemed

Key facts

Affected

  • Kaseya VSA customers
  • Managed service providers (MSPs) and their downstream customers

Initial access

  • supply_chain
  • vuln

Impact

  • encryption
  • service_disruption
  • financial_loss
  • extortion

Attribution

unknown med confidence

Public reporting often links the incident to known ransomware actors; the cited CISA sources emphasize the incident and mitigations rather than definitive attribution.

CVEs and ATT&CK

CVEs

CVE-2021-30116 · med
  • T1195.002: Attackers used a trusted software management platform to distribute malicious payloads downstream, consistent with software supply chain compromise.
  • T1486: The campaign resulted in ransomware encryption and extortion across downstream endpoints.

Mitigations

Now

  • Verify software update integrity and restrict update channelsReduces risk of consuming malicious updates and limits update traffic to known, validated endpoints.

Soon

  • Strengthen build and release pipeline security (signing keys, least privilege, monitoring)Protects upstream systems that can distribute attacker-controlled code to many downstream environments.

Later

  • Require SBOMs and third-party security attestations for critical suppliersImproves visibility into dependencies and enables faster response when supplier compromises occur.

Detection ideas

Monitor for unusual outbound connections from recently updated software

Alert when newly updated binaries initiate new or rare external connections, especially to unfamiliar domains or IP ranges.

Data sources: DNS logs, Proxy logs, EDR telemetry

Detect unexpected persistence or new services after update

Alert on creation of new services, scheduled tasks, or startup items immediately following a software update outside change windows.

Data sources: EDR telemetry, Windows Security Event Logs, Configuration management logs

Sources