Breaking Alert: MSP Targeted Ransomware Attack (Kaseya Supply Chain Attack)

Executive summary: On July 2, a REvil ransomware supply-chain attack exploited unpatched vulnerabilities in on‑premises Kaseya VSA to infect Managed Service Providers and downstream customers (reported ~1500 impacted); the report documents the timeline, detailed TTPs (malicious CMD/Powershell chain, certutil decoding of agent.exe, DLL hijacking via MsMpEng and mpsvc.dll), detection capabilities of vendor products, IoCs, and immediate mitigations including taking VSA servers offline and applying vendor runbook/patches.