Kaseya hack: FBI had the master key - and withheld it for weeks

 After the attack on the IT company Kaseya in July 2021, the master key for the locked data came from the FBI - but with a delay.

Several hundred companies are affected in July 2021 when the hacker group Revil exploits a vulnerability of the IT service provider Kaseya: Using malware, data on the hard drives of numerous customers is encrypted. The extent of the attack is particularly obvious in Sweden, where almost all branches of the supermarket chain Coop have to be temporarily closed. The attackers' ransom demand for decrypting the locked data: 70 million US dollars (about 59 million euros) in the digital currency Bitcoin.

Kaseya attack: FBI waited almost 3 weeks to hand over keys

A few weeks after the attack, a "trusted third party" plays a master key to Kaseya; whether the company had to pay for it, and if so, what sums, remains open. Now it should be clear who that third party was and why hacked customers had to wait nearly three weeks for redemption from their threatening slumber. The Washington Post cites "several current and former U.S. officials" as whistleblowers - and cites the FBI as the transmitter of the key. By accessing Revil servers, the security agency had obtained the master key shortly after the attack. According to the Washington Post, if the affected data had been unlocked immediately, the millions of dollars in consequential damage caused by the attack could have been prevented or at least significantly reduced.

Kaseya master key: the reasons for the delay

However, the FBI had initially kept the successful access secret, with the approval of other parties, in order to be able to carry out a counterstrike on Revil without arousing the group's suspicions in advance. In addition, a government assessment concluded that the extent of the damage was not as great as originally feared. The counterattack never happened, however; the hackers' platform went offline in mid-July without the FBI's intervention, and Revil had withdrawn from the network.

"The questions we ask ourselves every time: What would be the value of a key if it were exposed? How many victims are there? Who can be helped?" the Washington Post quotes an anonymous interviewee as saying. "And on the other hand, how valuable would a potentially more long-term operation to destroy an ecosystem be? Those are the questions we need to continue to balance."

FBI Director Christopher Wray spoke to a Senate committee on Sept. 21 about the procedures. He attributed the delays to, among other things, collusion with various other organizations, such as the Cybersecurity and Infrastructure Security Agency, as well as testing and validation of the key, The Hill reports.  Overall, Wray's testimony was part of an ongoing review process in which the U.S. Congress is discussing several bipartisan proposals on how to handle cyber incident reporting to best address related attacks.