# Rapid Response: Mass MSP Ransomware Incident

REvil exploited an auth bypass, arbitrary file upload, and SQL injection in Kaseya VSA to push ransomware to ~1,000+ MSP downstream businesses.

- Payout: Real-world hack
- Severity: critical
- Program: Kaseya VSA
- Credited: Huntress
- Disclosed: 2021-07-03
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-kaseya-vsa-mass-msp-ransomware-incident
- Tags: domain:web impact:funds-loss impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical technique:chained technique:source-review vuln:auth-bypass vuln:file-upload vuln:rce vuln:sqli

**Target:** Kaseya VSA on-prem web interface (dl.asp, KUpload.dll, userFilterTableRpt.asp)
**Root cause:** A logic flaw in dl.asp's authentication process allowed session impersonation of a valid agent, granting access to authenticated endpoints KUpload.dll (arbitrary upload) and userFilterTableRpt.asp (SQL injection), enabling code execution.
**Steps:**
1. `curl` GET `/dl.asp` to obtain a valid/impersonated session via auth logic flaw
2. POST to `/KUpload.dll` to upload `agent.crt` and `Screenshot.jpg` into `\Kaseya\WebPages\ManagedFiles\VSATicketFiles\`
3. POST to `/userFilterTableRpt.asp` with SQLi payload to execute commands as the VSA SQL user
4. Create VSA procedure 'Kaseya VSA Agent Hot-fix' running cmd.exe/powershell to disable Defender and decode `agent.crt` to `agent.exe`
5. Procedure sleeps via `ping 127.0.0.1 -n #diffSec#` until 16:30 UTC, then executes `agent.exe` on all agents
6. agent.exe drops MsMpEng.exe + mpsvc.dll to C:\Windows for DLL sideload and encrypts endpoints
**How found:** Huntress analyzed hundreds of VSA logs from compromised servers, found a common sequence of curl GET/POST to /dl.asp, /KUpload.dll, /userFilterTableRpt.asp from an AWS IP; noted dl.asp had proper SQL sanitization but a logic flaw in auth, KUpload.log proved agent.crt/Screenshot.jpg uploads, and userFilterTableRpt.asp had SQLi; VSA security notifications showed KElevated SQL user disabling admin accounts before encryption.
**Exploitation:** Attacker used curl from cloud IPs (18.223.199.234 AWS, etc.) to hit dl.asp, KUpload.dll, userFilterTableRpt.asp sequentially; uploaded agent.crt via KUpload, then used SQLi in userFilterTableRpt.asp to create a VSA procedure that disabled Defender, decoded agent.crt to agent.exe, and synchronized execution at exactly 1630 UTC across all downstream agents via a computed ping delay, deploying REvil/Sodinokibi ransomware.
**Escalation:** Compromised VSA server pushed the encryptor through the RMM agent to all managed downstream endpoints, scaling one intrusion to 1,000+ businesses across ~30 MSPs.
**Insight:** When a vendor's own detection tool only checks for a single ASP file's presence, that file is the injection point—read it for SQLi and trace the auth-gated upload endpoint (KUpload.dll) it sits behind; also correlate VSA security-notification emails naming the SQL user to confirm code execution path.