An update on the Kaseya ransomware attack CNC domains

by Peter Lowe on Jul 9, 2021 12:00:00 AM

Command and Control Domains

The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.

The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.

Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.

This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.

Important notes

The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".

If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.

Further information

For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:

Topics: MSPs Startups Education Featured DevOps Events Security Healthcare DNS AI DNSFilter

NETWORK SECURITY FOR REMOTE WORKERS

The shift from in-office to remote work happened (quite literally) overnight. Work from home was forced onto many during the onset of the COVID pandemic, and it was astonishing how quickly people and organizations alike adapted to this new work style.

Moving Beyond Traditional Network-Based Security

Zero Trust Network Access (ZTNA) is a cybersecurity paradigm that is rapidly gaining popularity among IT professionals. At its core, ZTNA is about moving away from the traditional network-based security perimeter approach and instead focusing on the users, assets, and resources that make up a system.

DNSFilter Achieves SOC 2 Type II Compliance

When DNSFilter was founded in 2015, we had a vision to build a product that would keep people and businesses safe and secure while they were using the internet. As a part of that vision, we have also worked diligently to ensure our growing organization maintains a high level of information security.