Cybersecurity teams worked feverishly Sunday to stem the impact of the single biggest global ransomware attack on record, with some details emerging about how the Russia-linked gang responsible breached the company whose software was the conduit. An affiliate of the notorious REvil gang, best known for extorting USD 11 million from the meat-processor JBS after a Memorial Day attack, infected thousands of victims in at least 17 countries on Friday, largely through firms that remotely manage IT infrastructure for multiple customers, cybersecurity researchers said.
They reported ransom demands of up to USD 5 million.
The FBI said in a statement Sunday that it was investigating the attack along with the federal Cybersecurity and Infrastructure Security Agency, though "the scale of this incident may make it so that we are unable to respond to each victim individually."
President Joe Biden suggested Saturday the US would respond if it was determined that the Kremlin is at all involved. He said he had asked the intelligence community for a "deep dive" on what happened.
The attack comes less than a month after Biden pressed Russian President Vladimir Putin to stop providing safe haven to REvil and other ransomware gangs whose unrelenting extortionary attacks the US deems a national security threat.
A broad array of businesses and public agencies were hit by the latest attack, apparently on all continents, including in financial services, travel and leisure and the public sector, though few large companies, the cybersecurity firm Sophos reported.
Ransomware criminals break into networks and sow malware that cripples networks on activation by scrambling all their data. Victims get a decoder key when they pay up.
The Swedish grocery chain Coop said most of its 800 stores would be closed for a second day Sunday because their cash register software supplier was crippled.
A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT were also hit.
In Germany, an unnamed IT services company told authorities several thousand of its customers were compromised, the news agency dpa reported.
Also among reported victims were two big Dutch IT services companies, VelzArt and Hoppenbrouwer Techniek.
Most ransomware victims don't publicly report attacks or disclose if they've paid ransoms.
CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like "dental practices, architecture firms, plastic surgery centres, libraries, things like that."
Voccola said in an interview that only between 50-60 of the company's 37,000 customers were compromised. But 70 per cent were managed service providers who use the company's hacked VSA software to manage multiple customers.
It automates the installation of software and security updates and manages backups and other vital tasks.
Experts say it was no coincidence that REvil launched the attack at the start of the Fourth of July holiday weekend, knowing US offices would be lightly staffed.
Many victims may not learn of it until they are back at work on Monday.
The vast majority of end customers of managed service providers "have no idea" what kind of software is used to keep their networks humming, said Voccola, Kaseya said it sent a detection tool to nearly 900 customers on Saturday night.
John Hammond of Huntress Labs, one of the first cybersecurity firms to sound the alarm on the attack, said he'd seen USD 5 million and USD 500,000 demands by REVil for the decryptor key needed to unlock scrambled networks.
The smallest amount demanded appears to have been USD 45,000.
Sophisticated ransomware gangs on REvil's level usually examine a victim's financial records, and insurance policies if they can find them, from files they steal before activating the data-scrambling malware.
The criminals then threaten to dump the stolen data online unless paid.
It was not immediately clear if this attack involved data theft, however.
The infection mechanism suggests it did not.
"Stealing data typically takes time and effort from the attacker, which likely isn't feasible in an attack scenario like this where there are so many small and mid-sized victim organizations," said Ross McKerchar, chief information security officer at Sophos.
"We haven't seen evidence of data theft, but it's still early on and only time will tell if the attackers resort to playing this card in an effort to get victims to pay."
Dutch researchers said they alerted Miami-based Kaseya to the breach and said the criminals used a "zero day," the industry term for a previous unknown security hole in software.
Voccola would not confirm that or offer details of the breach — except to say that it was not phishing.
"The level of sophistication here was extraordinary," he said.
When the cybersecurity firm Mandiant finishes its investigation, Voccola said he is confident it will show that the criminals didn't just violate Kaseya code in breaking into his network but also exploited vulnerabilities in third-party software.
It was not the first ransomware attack to leverage managed services providers. In 2019, criminals hobbled the networks of 22 Texas municipalities through one.
That same year, 400 US dental practices were crippled in a separate attack.