Blog | DIVD CSIRT

Kaseya VSA Limited Disclosure 07 July 2021, by Frank Breedijk

A short retrospective on DIVD-2021-00002 - Kaseya VSA case

Kaseya Case Update 3 06 July 2021, by Lennaert Oudshoorn

Since the start of the incident last Friday, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2.200 to less than 70 in our last scan today.

Kaseya Case Update 2 04 July 2021, by Victor Gevers

During the last 48 hours, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2.200 to less than 140 in our last scan today. And, by working closely with our trusted partners and national CERTs, the number of servers in The Netherlands has dropped to zero. A good demonstration of how a cooperative network of security-minded organizations can be very effective during a nasty crisis.

Kaseya Case Update 03 July 2021, by Lennaert Oudshoorn

Yesterday an attack on Kaseya VSA led to a large ransomware spree, because DIVD was already investigating this kind of product and we were able to react quickly.

Kaseya VSA Advisory 02 July 2021, by Lennaert Oudshoorn

Users of on-premise Kaseya VSA are advised to disable their Kaseya VSA servers.

vCenter Server PreAuth RCE 06 June 2021, by Hidde Smit

A critical vulnerability has been found in VMware vCenter Server versions 3.x, 4.x, 6.5, 6.7 and 7.0.

Warehouse Botnet 03 June 2021, by Gerard Janssen

DIVD-researcher Tom Wolters vond een grote database met gebruikersnamen, wachtwoorden en authenticatie-cookies / DIVD researcher Tom Wolters has found a large database with usernames, passwords and authentication cookies

Closing ProxyLogon case / Case ProxyLogon gesloten 14 May 2021, by Frank Breedijk

Het DIVD CSIRT sluit case DIVD-2021-00001 en draagt deze over aan de onderzoeksgroep / DIVD CSIRT closes case DIVD-2021-00001 and hands it over to the research group

Vembu Zero Days 11 May 2021, by Gerard Janssen

DIVD-researcher Wietse Boonstra vond vier zerodays in de Vembu BDR en gerelateeerde software / DIVD reseacher Wietse Boonstra has found four zero day vulnerabilities in Vembu BDR and related software

Pulse Secure PreAuth RCE 10 May 2021, by Matthijs Koot

Er zijn kritieke kwetsbaarheden gevonden in Pulse Secure Connect versies >=9.0R3 en <9.1R11.4. / Critical vulnerabilities have been found in Pulse Secure Connect versions >=9.0R3 and <9.1R11.4.