News of the Cyber World

[kyonides]

Kaseya obtains decryption key
for victims of massive ransomware attack

Roughly three weeks after Russia-based ransomware group REvil attacked Kaseya, the Florida-based IT firm has obtained a working decryption key to unlock encrypted files belonging to hundreds of victims, a spokesperson confirmed to CyberScoop on Thursday.
Dana Liedholm, the company’s senior vice president of marketing, declined to comment on the source of the key, other than to say it came from a “trusted third party.” She also declined to comment when asked if the company had paid to obtain the key, or and on long it would take to remediate all the clients that had been impacted by the attack.
Security firm Emisoft confirmed in a blog post that the decryptor works and it has been working with customers to restore their files.
...
Private cybersecurity firms have suggested a higher figure, as Huntress Labs estimated the number of victims at closer to 2,000. Sophos Labs identified 145 victims in the United States, including local and state agencies, governments, and small and medium-sized businesses.
Hackers exploited a Kaseya platform that’s used by managed service providers, or companies that provide third-party IT service to other organizations. Because these companies have administration privileges with their clients, the number of victims quickly spiraled beyond Kaseya and its direct customers.
Among the victims are New Zealand schools, international textile company Miroglio Group, Swedish grocery store chain COOP, and two Maryland towns.

Earlier this month...

Maryland Towns Impacted in Kaseya Ransomware Breach

The towns of Leonardtown and North Beach, both located along the Chesapeake Bay, both confirmed this week their computers and networks had been disabled, with some municipal services disrupted. In North Beach, town staff said they became aware of network issues at around 12:30 p.m. last Friday, about the time news of the Kaseya incident was unfolding.

It's fine to know that they have finally retrieved the encryption key but we don't know what's the actual price being paid there...