Where keeping it cost them

Kaseya

An RMM agent carried one compromise into 1,500 businesses

A remote monitoring agent with extensive permissions across customer networks turned into a lateral movement tool once it was compromised.

standing access
supply chain

Removed: nothing. The agent kept extensive permissions across every customer network it administered.

Outcome: 1,500+ businesses affected when the agent was compromised.

The 2021 Kaseya ransomware attack exploited the company’s VSA remote monitoring tool. This agent had extensive permissions across customer networks. When compromised, it became the perfect lateral movement tool.

Source: CISA, advisory AA21-209A (20 August 2021)

More cases like this

Distributed a compromised update to 18,000 customers

HVAC vendor credentials reached the payment network

Cut local admin accounts from 13,875 to 5,385

A package thousands of projects trusted changed hands