---
title: "How recent attacks could have been mitigated with Cynergy?"
canonical: "https://kb.cynergy.app/space/WC/902856717/How%20recent%20attacks%20could%20have%20been%20mitigated%20with%20Cynergy%3F"
format: markdown
---
| **Company Name** | **Impact** | **Description** | **Source** | **Why Cynergy** |
| --- | --- | --- | --- | --- |
| Kaseya - Worldwide IT provider | Systemic risk or incalculable due to Kaseya’s clients’ and 3rd parties’ widespread  
use of VSA. | Kaseya is a Managed Service Provider (MSP) that provides IT solutions to more than 40,000 companies worldwide. They use  
and provide VSA software, a unified remote monitoring and patch management tool for handling networks and endpoints.  
On 2nd July 2021, Kaseya’s incident response team reported a potential security incident involving this software which would  
potentially affect both on-premises and SaaS clients. Attackers were able to exploit a vulnerability and bypass authentication to  
then run an arbitrary command execution. Essentially, the attackers leveraged the standard VSA product functionality so as to  
deploy a ransomware known as REvil.  
According to MITRE, REvil is a highly configurable ransomware family linked to the GOLD SOUTHFIELD group that has  
operated as ransomware-as-a-service (RaaS) since April 2019 or earlier. Main techniques used in these attacks include data  
encryption, data exfiltration and data destruction. | [https://www.kaseya.com/potential-attack-on-kaseya-vsa/](https://www.kaseya.com/potential-attack-on-kaseya-vsa/) | 1. Cynergy would identify the exposed asset.
2. Cynegy would enable running a VA against the exposed host, potentially identifing the uthentication bypass.
3. Notify the client
4. Cynergy would enable automated remidiation of the exposure by moving the asset behined a WAF.
5. End resault - No attack. |
| Microsoft Exchange -Worldwide IT provider | Systemic risk or incalculable due to Microsoft’s clients’ and 3rd parties’  
widespread use of Microsoft Exchange products. On 12th March, Microsoft and  
RiskIQ said at least 82,000 servers remained unpatched. | On 2nd March 2021, Microsoft released out-of-band security updates to address vulnerabilities affecting Microsoft Exchange  
Server products.  
On 3rd March 2021, Cybersecurity and Infrastructure Security (CISA) partners observed active exploitation of vulnerabilities  
in Microsoft Exchange Server products, and issued an emergency directive and an alert. Successful exploitation of these  
vulnerabilities allows an unauthenticated attacker to execute arbitrary code on vulnerable exchange servers, enabling the  
attacker to gain persistent system access, access files and mailboxes on the server and credentials stored on that system.  
Successful exploitation may additionally enable the attacker to compromise trust and identity in a vulnerable network. | [https://www.cisa.gov/uscert/ncas/alerts/aa21-062a](https://www.cisa.gov/uscert/ncas/alerts/aa21-062a) | 1. Identify exposed Exchange Servers
2. Validate the exploitability
3. Notify the client
4. Prioritize
5. Mitigate the exposure by reducing the exposure, by moving the vulnerable asset behined a WAF.
6. End resault - prevent breach and data leak. |
| EA Games - User account takeover via Subdomain Takover vulnerability | Account takeover of over 300M users of EA games and Origin | An attacker interested in the company can see that it launched a new subdomain and then use the tool `dig` to see how it's hosted. If the attacker sees that the company has used a CNAME record to redirect to a cloud provider's internal DNS, the next step is to wait for the marketing campaign to complete and the URLs involved in the campaign to stop working. Now we `dig` the subdomain name again—if the original CNAME is intact, we're in business. Next, the attacker uses an account of their own at the same cloud provider and requests the same provider-internal DNS name originally used by the campaign.<br>At this point, the original CNAME is now pointing to the attacker's website, not one controlled by the actual company. Armed with a working subdomain of the company's real domain, cookies belonging to the company's users can be captured (and embedded!). This makes instant attacks versus victims using that company's services possible. | [https://arstechnica.com/information-technology/2019/06/security-firms-demonstrate-subdomain-hijack-exploit-vs-eaorigin/](https://arstechnica.com/information-technology/2019/06/security-firms-demonstrate-subdomain-hijack-exploit-vs-eaorigin/) | 1. Identify the host that is suspect to Subdomain Takover.
2. Validate the vulnerability
3. Notify the client
4. Trigger an automated subdomain take over that will iliminate the attack
5. End resault, the attack is prevented  client is safe to remidiate at his own pace, following internal proccess of change management. |
| Verizon - exposed s3 bucket exposed records of milions of Verizon clients | Reputetional damage and fines due to GDPR and CCPA breach | Verizon’s cybersecurity strategy has been found wanting again after researchers found a trove of sensitive corporate data in a publicly accessible Amazon S3 bucket, which could have given attackers access to parts of its network. | [https://www.techtarget.com/searchsecurity/news/450422709/Misconfigured-AWS-S3-bucket-exposes-millions-of-Verizon-customers-data](https://www.techtarget.com/searchsecurity/news/450422709/Misconfigured-AWS-S3-bucket-exposes-millions-of-Verizon-customers-data) | 1. Identify the exposed asset and S3 bucket.
2. Identify the content of the bucket.
3. Notify the client
4. Trigger an automae proccess to change the bucket policy from public to private.
5. End resault, Prevent the hackers from identifying the resource and prevent the assosiated reputational and regulation breach which may lead to milions of dolars in fines. |