Code-Signing Abuse × Kaseya VSA

malware was digitally signed by Kaseya's certificate, making it appear legitimate and evading endpoint detection

Attackers exploited zero-day vulnerabilities in the Kaseya VSA SaaS platform to push a malicious update to the VSA agent (agentmon.exe) installed on endpoints. The malware was digitally signed by Kaseya's certificate, making it appear legitimate and evading endpoint detection. The agent then executed the ransomware payload (mpsvc.dll) to encrypt files on affected systems.

Monitor for unexpected execution of Kaseya agent processes (e.g., agentmon.exe) spawning unusual child processes or network connections to known malicious IPs. Deploy application whitelisting and ensure endpoint protection is configured to inspect signed binaries for behavioral anomalies.