Deep Dive: Kaseya VSA Mining Payload

This Huntress report analyzes a Windows malware campaign that establishes persistence by creating scheduled tasks (including backdooring legitimate tasks) which execute Base64-encoded PowerShell payloads retrieved from Dropbox and stored in HKLM registry values; it describes architecture checks for x86/x64 payloads, obfuscation and evasion (registry path/name changes), provides IoCs and remediation/takedown actions, and notes coordination with Dropbox and updates to Kaseya removal procedures.