An update on the Kaseya ransomware attack CNC domains

by Peter Lowe on Jul 9, 2021 12:00:00 AM

Command and Control Domains

The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.

The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.

Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.

This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.

Important notes

The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".

If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.

Further information

For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:

Topics: Cyber Threats

7 Cybersecurity Predictions for 2026

AI and other technologies are fundamentally reshaping the security world. It’s never too early to prepare, which is why we're dropping our predictions for 2026 ahead of schedule! We went straight to the source, surveying our internal team of cybersecurity and technology specialists to find out where they see the battle lines forming. Here’s what our experts predict.

The Hire the Stakes, The Greater the Fall

Another late night, exhaustion and sore eyes setting in after sending what felt like the thousandth job application on your list, when yet another reply hits your inbox with the words, “Unfortunately we…”You don’t even need to read the rest; you’re familiar enough with how this goes. Woefully, you sit thinking about the work you’ve put into the job search: The degree, the blood, the sweat, the tears—ping. An email notification graces your frustra...

Risky Apps for Business: Top Malware and Phishing Threats

Not all apps are created equal. Some introduce serious risks for phishing, malware, or data breaches, especially when they’re adopted by employees without IT approval. And while blocking a website at the domain can prevent unauthorized access on your network, many applications have hundreds or thousands of domains—simply blocking the main domain might not be enough to prevent access.