Kaseya ransomware suspect nabbed in Poland, $6m seized from absent colleague – Bare Safety

The identify “Kaseya” has develop into one of many greatest phrases in ransomware infamy.

Cybercriminals penetrated the IT administration enterprise Kaseya earlier this 12 months and used the corporate’s personal distant administration instruments to wreak simultaneous ransomware havoc throughout its buyer base.

Sadly for the various victims of the assault, Kaseya’s software program required prospects to designate a particular space on their exhausting disks as exempt from anti-malware scanning.

The rationale, we’re guessing, is that somebody determined {that a} staging listing for gathering and distributing software program updates, the place utility information can be quickly saved as information however not executed as packages, didn’t should be protected as strongly as the remainder of the pc.

In any case, why scan the information over and over whereas they’re merely being downloaded, shuffled, organised and packaged for supply, as a substitute of ready to do a remaining scan solely of these information that in the end get used?

The issue with anti-malware “exclusion zones” of this type, nevertheless, is that they develop into a good hiding place for well-informed crooks, as a result of rogue code that’s secretly injected into the unprotected space may be launched with out producing any of the the same old alarms.