--- title: Cyberattack group REvil attacks MSPs and their clients in a supply-side attack description: MSPs that run Kaseya VSA software are on alert after the company told them to shut down on-premises VSA servers following a supply-chain attack by REvil canonical_url: https://www.acronis.com/en/blog/posts/cyberattack-group-revil-attacks-msps-and-their-clients-supply-side-attack/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Cyberattack group REvil attacks MSPs and their clients in a supply-side attack Managed service providers (MSPs) are on alert this holiday weekend as those that run Kaseya VSA software are being informed by the company to shut down their on-premises VSA servers following a suspected supply-chain attack on their remote management software. Kaseya proactively shut down their SaaS servers that run VSA for their partners. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: William Toll](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png)](https://www.acronis.com/en/blog/authors/william-toll/ "William Toll") [William Toll](https://www.acronis.com/en/blog/authors/william-toll/) 2 min read Last updated 06 July 2021 Other languages available:[日本語](https://www.acronis.com/ja/blog/posts/cyberattack-group-revil-attacks-msps-and-their-clients-supply-side-attack/) Managed service providers (MSPs) are on alert this holiday weekend as those that run Kaseya VSA software are being informed by the company to shut down their on-premises VSA servers following a suspected supply-chain attack on their remote management software. Kaseya proactively shut down their SaaS servers that run VSA for their partners. There are active threads on [Twitter](https://twitter.com/USCERT_gov/status/1411069203952640005) and [Reddit](https://www.reddit.com/r/msp/) as well as a continually updated post on Kaseya’s [website.](https://www.kaseya.com/potential-attack-on-kaseya-vsa/) [BleepingComputer.com](https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-200-companies-in-msp-supply-chain-attack/) has been told by security researchers that the attacks were likely performed through a malicious update of the Kaseya VSA agent called Kaseya VSA Agent Hot-fix. This update drops an agent.crt file and then uses the legitimate Windows certuil.exe file to decrypt the payload. The attackers then use a legitimate Microsoft Defender executable to sideload the ransomware payload. Additional details on the method can be found in Reddit threads. ### Why are MSPs targeted in Kaseya supply-chain attack MSPs are high-value targets, with attack surfaces that make them interesting to cybercriminals as they manage IT for large numbers of endpoints in their client organizations. This attack represents another leap forward in the scale, scope, and sophistication of attacks against the software vendors that serve MSPs. No private business, public institution, tech vendor, or service provider should be laughing or pointing fingers at either the initial victims of the attack or the members of their software supply chain that were comprised as a result. [Video 1](https://www.youtube.com/watch?v=_7f_BFMPGzk) ### How to avoid becoming a victim In light of this event, what can you do to reduce your risk of being victimized by a similar attack – one that would cause great harm to your reputation if you become a conduit for passing malware on to your partners and customers? Here are a few recommendations: * First, tend to your own backyard by renewing your commitment to building a multi-layered, defense-in-depth security architecture. Consider following an open security framework like NIST 800-171 or ISO/IEC 27001 to help work through various potential risks, identify your softest spots, and shore up those defenses. * Next, evaluate your vendors and service providers as a potential source of risk to you. Unless you’ve vetted their security measures, any organization could be a weak link in your software supply chain. Acronis has published an [e-book on supply-chain attacks](https://www.acronis.com/en-us/resource-center/resource/561/) which includes specific recommendations on how to evaluate the vendors and providers in your supply chain. You can download and review this e-book at [https://www.acronis.com/en-us/resource-center/resource/561/](https://www.acronis.com/en-us/resource-center/resource/561/) * Revisit your incident response management policy. If you don’t have one, start building one immediately. Assume that, at some point, a cybersecurity attack on you will eventually succeed – despite your best efforts to deploy comprehensive defenses, build solid security policies, and invest in good people. A well-constructed and regularly-rehearsed incident response plan can significantly limit the damage from such a cyberattack, reduce the external blowback from investors, partners, and customers, and preserve the kind of forensic evidence you’ll need to avoid a recurrence of the particular attack. ### Additional resources: * Learn how Acronis protects its customers against software supply-chain attacks with secure software development practices: [https://www.acronis.com/en-us/resource-center/resource/561/](https://www.acronis.com/en-us/resource-center/resource/561/) * Keep abreast of Acronis Smart Alerts distributed through Acronis Cyber Protection Operations Centers (CPOCs) * Check out additional complimentary cybersecurity advisories, analysis, and white papers in the [Acronis Resource Center](https://www.acronis.com/en-us/resource-center/) and on the [Acronis Blog](https://www.acronis.com/en-us/blog/), and our [cyber protection webinars.](https://acronis.events/) * Take advantage of Acronis Academy training courses to attain certification in secure deployment, operation, and support of Acronis Cyber Protect and other products * Learn more about cybersecurity at Acronis, as well as our bug bounty program, encryption technologies, and secure code development and self-defense technologies at [https://www.acronis.com/en-us/security/](https://www.acronis.com/en-us/security/). [Malware protection](https://www.acronis.com/en/blog/tags/malware-protection/) [Antivirus protection](https://www.acronis.com/en/blog/tags/antivirus-protection/) ## Written by ![Image 3: William Toll](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png) William Toll [Previous post](https://www.acronis.com/en/blog/posts/cyberthreats-evolve-training-keeps-you-ahead-curve/) [As cyberthreats evolve, training keeps you ahead of the curve](https://www.acronis.com/en/blog/posts/cyberthreats-evolve-training-keeps-you-ahead-curve/) [Next post](https://www.acronis.com/en/blog/posts/lockbit-ransomware/) [Threat analysis: LockBit ransomware](https://www.acronis.com/en/blog/posts/lockbit-ransomware/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read