Ransomware operators exploited Veeam Backup & Replication flaw CVE-2024-40711 in recent attacks

Sophos reports ransomware operators are exploiting a critical code execution flaw in Veeam Backup & Replication.

Sophos researchers warn that ransomware operators are exploiting the critical vulnerability CVE-2024-40711 in Veeam Backup & Replication to create rogue accounts and deploy malware.

In early September 2024, Veeam released security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.

The most severe flaw included in the September 2024 security bulletin is a critical, remote code execution (RCE) vulnerability tracked as CVE-2024-40711 (CVSS v3.1 score: 9.8) impacting Veeam Backup & Replication (VBR).

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. It enables organizations to back up, restore, and replicate data across physical, virtual, and cloud environments.

“A vulnerability allowing unauthenticated remote code execution (RCE).” reads the advisory.

Florian Hauser, cybersecurity researcher at CODE WHITE Gmbh, reported this vulnerability.

The flaw impacts Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds. 

Sophos X-Ops researchers observed recent attacks exploiting compromised credentials and Veeam vulnerability CVE-2024-40711 to deploy ransomware, including Fog and Akira. Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. Overlapping indicators link these cases to prior Fog and Akira ransomware attacks.

“Sophos X-Ops MDR and Incident Response are tracking a series of attacks in the past month leveraging compromised credentials and a known vulnerability in Veeam (CVE-2024-40711) to create an account and attempt to deploy ransomware.” reads a statement published by Sophos on Mastodon.

“In one case, attackers dropped Fog ransomware. Another attack in the same timeframe attempted to deploy Akira ransomware. Indicators in all 4 cases overlap with earlier Akira and Fog ransomware attacks. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Some of these VPNs were running unsupported software versions.”

Threat actors exploited the Veeam URI /trigger on port 8000 to spawn net.exe and create a local account, named “point,” adding it to the local Administrators and Remote Desktop Users groups. In one case, the attackers deployed Fog ransomware on an unprotected Hyper-V server and used rclone for data exfiltration.

“These cases underline the importance of patching known vulnerabilities, updating/replacing out-of-support VPNs, and using multifactor authentication to control remote access. Sophos X-Ops continues to track this threat behavior.” concludes Sophos.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Veeam Backup & Replication)