Loading story…
Multiple ransomware operations have exploited a critical Veeam Backup & Replication weakness, including CVE-2023-27532, to gain unauthorized access and deploy malware in victim environments. Reporting tied the activity to Akira, Fog, and later Frag ransomware, with attackers abusing exposed Veeam infrastructure to retrieve credentials and move deeper into networks. Rapid7's analysis of the flaw showed it could allow access to sensitive configuration data, making Veeam servers a high-value target for follow-on compromise.
Additional reporting said some intrusions also involved compromised VPN credentials, combining stolen remote-access accounts with exploitation of Veeam systems to establish footholds and launch ransomware. The incidents show attackers repeatedly targeting backup infrastructure not only to encrypt production systems but also to undermine recovery options, reinforcing the need to patch internet-exposed Veeam servers, restrict administrative access, and protect stored credentials tied to backup and remote-access platforms.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos later reported that the same Veeam exploit was observed again in attacks involving a newer ransomware family called Frag. This showed continued reuse of the Veeam attack path by additional ransomware operators.
TechRadar reported that threat actors were combining compromised VPN credentials with exploitation of the Veeam vulnerability to deploy malware. This added operational detail on intrusion chains beyond the earlier ransomware reporting.
By early October 2024, reporting indicated that the Akira and Fog ransomware groups were exploiting a critical Veeam remote code execution flaw in real-world attacks. The activity showed the vulnerability had moved from disclosure into active ransomware operations.
Rapid7 published analysis of CVE-2023-27532, a Veeam Backup & Replication vulnerability that later became associated with ransomware intrusion activity. This marks the earliest referenced public documentation of the flaw in the provided sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcetechradar.com
Open sourcebleepingcomputer.com
Open sourceattackerkb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple ransomware groups have been exploiting a critical authentication bypass in **Veeam Backup & Replication**, identified as **`CVE-2024-40711`**, to gain access to backup infrastructure and deploy ransomware. Reporting tied the activity to at least one newly observed ransomware operation, with attackers abusing the flaw to compromise internet-exposed Veeam servers, move deeper into victim environments, and target backup systems that are often central to recovery efforts. The vulnerability affects domain-joined Veeam Backup & Replication servers, and successful exploitation can allow remote code execution under certain conditions. Security reporting said the bug was being used in real-world intrusions shortly after disclosure, underscoring the risk to organizations that rely on Veeam for business continuity. Defenders were urged to patch affected systems, restrict external exposure of backup management interfaces, and monitor Veeam infrastructure for signs of unauthorized access or ransomware deployment.
Jul 12, 2026
Sophos X-Ops reported that attackers in threat cluster **STAC 5881** again exploited Veeam backup servers through **`CVE-2024-40711`** after first obtaining access through compromised VPN appliances. The activity follows earlier intrusions tied to **Akira** and **Fog** ransomware, but the latest case used a previously undocumented ransomware family called **Frag**. During the intrusion, the attackers created local administrator accounts named **`point`** and **`point2`**, repeating tradecraft seen in prior incidents. **Frag** is a command-line ransomware that requires an encryption-percentage parameter, can be directed at specific files or directories, and appends the **`.frag`** extension to encrypted data. Sophos said its **CryptoGuard** protection blocked the encryption attempt and that detection for the Frag binary has since been added. Sophos and Agger Labs said the operation shares tactical similarities with actors linked to Akira and Fog, indicating that a new ransomware operator may be reusing established access methods and post-compromise techniques against Veeam environments.
Jun 29, 2026
Veeam released security updates for multiple products, including **Backup & Replication**, **Service Provider Console**, **Veeam ONE**, **Agent for Linux**, and several backup plug-ins, to fix a set of critical and high-severity vulnerabilities. The most severe issue, **`CVE-2024-40711`**, is a critical unauthenticated remote code execution flaw in **Veeam Backup & Replication** with a **CVSS 9.8** rating, allowing attackers to potentially compromise backup servers without logging in. The broader patch set also addresses weaknesses that could enable credential theft, backup manipulation, MFA bypass, privilege escalation, SSRF exploitation, and additional remote code execution in other Veeam components. Security advisories urged organizations to upgrade immediately to fixed versions, warning that backup infrastructure is a high-value target and that successful exploitation could materially increase ransomware risk by giving attackers access to recovery systems.
Jul 24, 2026