Kaseya VSA included at least “seven or eight” privately known zero-day vulnerabilities before it suffered a widespread ransomware attack that impacted hundreds of businesses, said Victor Gevers, chair of the Dutch Institute for Vulnerability Disclosure, or DIVD, a volunteer-run organization that found a remote code execution flaw in Kaseya VSA on April 1, 2021. In speaking with Malwarebytes for its Lock and Code podcast (embedded below), Gevers revealed that Kaseya VSA’s vulnerabilities represent just one data point in a far larger and more worrying trend—that Internet-facing remote administration tools are rife with flaws and that, as organizations increasingly rely on such tools for working-from-home environments, cybercriminals will increasingly discover, target, and exploit those flaws.

Read full article on Malwarebytes Unpacked