Huntress VSA Vaccine: Acting Like Hackers To Protect Our Partners | Huntress

On July 2, 2021 REvil used compromised Kaseya VSA servers to push Sodinokibi ransomware to MSP clients; Huntress analyzed the payload (noting the use of a renamed certutil to decode a base64 agent.crt into agent.exe) and issued an emergency mitigation by deploying a benign agent.exe 'vaccine' to endpoints while sharing hashes and guidance with vendors and partners.