The cyber threat from supply chains - Canadian Centre for Cyber Security

The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116Footnote 4 and CVE-2021-30120,Footnote 5 which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.Footnote 6

“CVE-2021-30116 Detail.”

The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116Footnote 4 and CVE-2021-30120,Footnote 5 which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.Footnote 6

“CVE-2021-30120 Detail.”