What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

Kaseya Update - Cryptocurrency Mining Campaign

February 26, 2019 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

eSentire has observed recent threat activity attributed to an active crypto-currency mining campaign leveraging Kaseya’s Virtual System Administrator (VSA). eSentire has worked with Kaseya to share details of this threat. On 2018-02-16, Kaseya released critical patches for their VSA product in addition to updated remediation actions for impacted customers [1]. eSentire recommends impacted customers review and deploy security updates contained in the advisory as soon as possible.

What we’re doing about

What you should do about it

Additional information

eSentire originally notified customers about an active cryptocurrency-mining campaign leveraging Kaseya VSA on 2018-01-29 [2]. Kaseya released patches for their VSA product which addressed the threat at the time.

Over the last several weeks, eSentire responded to multiple incidents across our customers which we attributed to the same cryptocurrency-mining campaign. In each incident, eSentire worked with our customers to identify and contain the threat. During this period, we provided Kaseya with updated information pertaining to the threat. Additionally, we updated our original advisory with new information.

On 2018-02-16, Kaseya updated their original URL with new guidance for their VSA customers [1]. This includes patches, identification scripts, and remediation actions. eSentire recommends impacted customers to review Kaseya’s guidance on this matter and apply the latest patches as soon as possible. We are also recommending customers rotate passwords for their VSA product post-patch and implement two-factor authentication.

[1] https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152-Q1-2018-VSA-Security-Update

[2] https://www.esentire.com/news-and-events/security-advisories/kaseya-virtual-system-administrator/

View Most Recent Advisories