TeamHood 
The REvil gang have apparently used Kaseya — a software platform designed to help manage IT services remotely — to deliver their payload to its multiple customers. Initial notification from kaseya suggested that so far 40 customers are impacted. But it is reported that more that 400 companies in US alone is impacted by this attack.
Sophos director and ethical hacker Mark Loman tweeted about the attack on Friday, and reported that affected systems will demand $44,999 to be unlocked. A note on Kaseya’s website implores customers to shut off their VSA servers for now “because one of the first things the attacker does is shutoff administrative access to the VSA.”
In a statement, Kaseya told that “We are investigating a potential attack against the VSA that indicates to have been limited to a small number of our on-premises customers only.” A notice claims that all of its cloud servers are now in “maintenance mode,” a move that the spokesperson said is being taken due to an “abundance of caution.” Later on Friday evening, Kaseya CEO Fred Voccola issued a statement saying they estimated the number of MSPs affected is fewer than 40, and are preparing a patch to mitigate the vulnerability.
“While our early indicators suggested that only a very small number of on-premises customers were affected, we took a conservative approach in shutting down the SaaS servers to ensure we protected our more than 36,000 customers to the best of our ability,” Voccola said in the statement, adding that the company’s SaaS customers were never at risk, and reiterating that “only a very small percentage of our customers were affected.”
On Saturday, Bloomberg reported that the attack was affecting more than 1,000 businesses in a ripple effect; the attack focused on managed service providers, but these providers offer IT services to other companies that may now be affected as well. A grocery chain in Sweden reported it couldn’t open 800 of its stores on Saturday when the attack resulted in its cash registers malfunctioning, Bloomberg reported.
The attack has been linked to the notorious REvil ransomware gang (already linked to attacks on Acer and meat supplier JBS earlier this year), and The Record notes that, collecting incidents under more than one name, this may be the third time Kaseya software has been a vector for their exploits.
Kaseya said Saturday it would provide updates on the situation every three to four hours.
