An update on the Kaseya ransomware attack CNC domains

An update on the Kaseya ransomware attack CNC domains

Peter Lowe
July 9, 2021

Command and Control Domains

The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.

The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.

Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.

This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.

Important notes

The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".

If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.

Further information

For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:

Latest posts
Black Hat 2022 Fireside Chat

DNSFilter at Black Hat 2022: What we loved, liked, and wanted more of.

Ransomware, Malware, and Phishing (Oh My): How to Keep Your Business Data Safe

DNSFilter | The Overlap Between Ransomware, Malware, and Phishing: How to Keep Your Business Data Safe

Domain Classification—A Look Down the Rabbit Hole

Domain Classification—A Look Down the Rabbit Hole

Explore More Content

Ready to brush up on something new? We've got even more for you to discover.
dnsfilter ai powered dns security

Intelligent web content filtering

No comparison. No compromises. No-brainer pricing.
dnsfilter is soc2 certified