Kaseya received a universal decryptor that allows victims of the July 2nd REvil ransomware attack to recover their files for free. On July 2nd, the REvil ransomware operation launched a massive attack by exploiting a zero-day vulnerability in the Kaseya VSA remote management application to encrypt approximately sixty managed service providers and an estimated 1,500 businesses. After the attack, the threat actors demanded $70 million for a universal decryptor, $5 million for MSPs, and $40,000 for each extension encrypted on a victim's network. Soon after, the REvil ransomware gang mysteriously disappeared, and the threat actors shut down their payment sites and infrastructure. While most victims were not paying, the gang's disappearance prevented companies who may have needed to purchase a decryptor unable to do so. Today, Kaseya has stated that they received a universal decryptor for the ransomware attack from a "trusted third party" and are now distributing it to affected customers.

After the attack on JBS and Kaseya, the White House's has pressured the Russian government to do something about the ransomware gangs believed to be operating within Russia. It is believed that the Russian government told the REvil ransomware gang to shut down and disappear to show that they were working with the USA. As the decryptor was obtained after the REvil gang's disappearance, it is possible that Russia received it directly from the ransomware gang and shared it with US law enforcement as a gesture of goodwill. When we asked the FBI if they were involved in the procurement of the decryption key, we were told that they do not comment on ongoing investigations.