# The Hunt to Find Origins of Kaseya's VSA Mass Ransomware

Kaseya VSA's /dl.asp logged in users supplying a valid Agent GUID without a password, enabling file upload and RCE that REvil used to encrypt 50-60 MSPs.

- Payout: Real-world hack
- Severity: critical
- Program: Kaseya VSA
- Analysis by: Huntress
- Disclosed: 2021-07-20
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident
- Tags: area:web domain:web impact:funds-loss impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical technique:chained vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** /dl.asp endpoint on public-facing Kaseya VSA server
**Root cause:** /dl.asp's authentication logic accepted a valid Agent GUID (or Display Name) in place of a password, logging the requester in without credentials.
**Steps:**
1. Send a request to the public-facing `/dl.asp` with no password but a valid Kaseya Agent GUID (15-char random string) as the identifier.
2. Server authenticates the session successfully, granting access to functionality requiring authentication.
3. Use authenticated access to perform arbitrary file upload.
4. Achieve remote code execution on the VSA server.
5. Push malicious stored procedures/agent commands to managed endpoints to deploy REvil ransomware.
**How found:** Huntress reconstructed the attack chain from logs and confirmed malicious access by supplying only a unique Agent GUID; absence of failed auth attempts indicated GUIDs were known in advance, prompting speculation on how they were obtained (rogue agent registration, compromised agent host registry, CVE-2021-30116/30117 leaks, prior dark-web dumps).
**Exploitation:** Attackers synchronized exploitation at 1230 ET July 2, with suspicious Kaseya procedure execution observed as early as 0109 ET. They bypassed auth on /dl.asp using pre-known Agent GUIDs (no failed attempts in logs), then chained arbitrary file upload and RCE to push ransomware to 50-60 MSPs and their managed customers.
**Escalation:** Auth bypass chained to arbitrary file upload and RCE, then leveraged VSA's MSP trust relationship to encrypt downstream managed customers.
**Insight:** Agent-installer download endpoints that authenticate by device identifier rather than user credential are a bypass primitive; check whether a GUID/Display Name alone satisfies auth, and whether GUIDs leak via registry on managed hosts or prior disclosures.