Kaseya Denied Paying Off The BTC Ransom Worth $70 Million

IT software provider Kaseya denied paying off the Bitcoin ransom demand worth $70 million after it obtained a decryptor key but refused to say how so let’s read more in our latest Bitcoin news today.

Kaseya and its clients were a victim of a ransomware attack in July but the company obtained a decryptor key and shared it with its clients but it still won’t tell how it got the tool. IT Software provider Kaseya denied paying off the ransom after it got crippled by an attack attributed to Russia-based hacking group REVil. The ransomware attack compromised the software and removed the clients’ administrator access and ReVIL demanded $70 million to BTC to restore normal operations.

Last week, it announced that it received the decryptor key to undo the attack which affected plenty of businesses that use the software. It declined to say how it got the keys beyond that it had come from a trusted third party that led to speculation that it had paid the $70M bitcoin ransom. Kaseya reported:

“We are confirming in no uncertain terms that Kaseya did not pay a ransom—either directly or indirectly through a third party—to obtain the decryptor.”

Others paid such ransoms despite earnings a year ago from the Treasury Department that paying hackers is a violation of US sanctions against foreign actors. Meat producer JBS USA paid $11 million BTC ransom to ReVIL back in June after it threatened one-quarter of the meat supply in the country. A month before that, Colonial Pipeline paid a $4.4 million BTC payment to Russia’s connected DarkSIDe group. Kaseya wrote:

“While each company must make its own decision on whether to pay the ransom, Kaseya decided after consultation with experts to not negotiate with the criminals who perpetrated this attack and we have not wavered from that commitment. Kaseya decided after consultation with experts to not negotiate with the criminals who perpetrated this attack…”

The denial gives added weight to competing theories suggesting that the company received the decryption keys with governemnt channels. President Joe Biden threatened Russia’s president with consequences if Russia chooses not to act on ransomware attacks that happen within its borders. The US promised to share intelligence with Russia on the matter and REVil disappeared from the dark web subsequently. Ransom payments had cost companies this year about $81 million according to Chainalysis which doesn’t account for the costs of network outages or working to restore services independently.