Loading story…
Sophos X-Ops reported that attackers in threat cluster STAC 5881 again exploited Veeam backup servers through CVE-2024-40711 after first obtaining access through compromised VPN appliances. The activity follows earlier intrusions tied to Akira and Fog ransomware, but the latest case used a previously undocumented ransomware family called Frag. During the intrusion, the attackers created local administrator accounts named point and point2, repeating tradecraft seen in prior incidents.
Frag is a command-line ransomware that requires an encryption-percentage parameter, can be directed at specific files or directories, and appends the .frag extension to encrypted data. Sophos said its CryptoGuard protection blocked the encryption attempt and that detection for the Frag binary has since been added. Sophos and Agger Labs said the operation shares tactical similarities with actors linked to Akira and Fog, indicating that a new ransomware operator may be reusing established access methods and post-compromise techniques against Veeam environments.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos and Agger Labs reported tactical similarities between the actor behind Frag and actors associated with Akira and Fog. They said the overlap may indicate the emergence of a new ransomware operator using familiar tradecraft.
Sophos said its CryptoGuard feature blocked the Frag ransomware in the observed incident. The company also stated that a detection for the Frag binary has since been added.
In a more recent case, Sophos observed the same cluster using similar tradecraft but deploying a previously undocumented ransomware family named Frag instead of Akira or Fog. The attackers again created a local administrator account named "point" and also created a second account named "point2."
Sophos X-Ops said threat cluster STAC 5881 had previously exploited Veeam backup servers via CVE-2024-40711 after access through compromised VPN appliances. Those earlier incidents resulted in deployment of Akira or Fog ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple ransomware operations have exploited a critical Veeam Backup & Replication weakness, including **`CVE-2023-27532`**, to gain unauthorized access and deploy malware in victim environments. Reporting tied the activity to **Akira**, **Fog**, and later **Frag** ransomware, with attackers abusing exposed Veeam infrastructure to retrieve credentials and move deeper into networks. Rapid7's analysis of the flaw showed it could allow access to sensitive configuration data, making Veeam servers a high-value target for follow-on compromise. Additional reporting said some intrusions also involved **compromised VPN credentials**, combining stolen remote-access accounts with exploitation of Veeam systems to establish footholds and launch ransomware. The incidents show attackers repeatedly targeting backup infrastructure not only to encrypt production systems but also to undermine recovery options, reinforcing the need to patch internet-exposed Veeam servers, restrict administrative access, and protect stored credentials tied to backup and remote-access platforms.
Jun 29, 2026
Multiple ransomware groups have been exploiting a critical authentication bypass in **Veeam Backup & Replication**, identified as **`CVE-2024-40711`**, to gain access to backup infrastructure and deploy ransomware. Reporting tied the activity to at least one newly observed ransomware operation, with attackers abusing the flaw to compromise internet-exposed Veeam servers, move deeper into victim environments, and target backup systems that are often central to recovery efforts. The vulnerability affects domain-joined Veeam Backup & Replication servers, and successful exploitation can allow remote code execution under certain conditions. Security reporting said the bug was being used in real-world intrusions shortly after disclosure, underscoring the risk to organizations that rely on Veeam for business continuity. Defenders were urged to patch affected systems, restrict external exposure of backup management interfaces, and monitor Veeam infrastructure for signs of unauthorized access or ransomware deployment.
Jul 12, 2026
Sophos reported that **Akira** has become a major threat to small and medium-sized organizations across Europe, North America, and Australia, hitting sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. The group commonly gained initial access through unauthorized logins to **Cisco ASA SSL VPN** and **Cisco AnyConnect** systems that lacked MFA, and in some cases exploited `CVE-2023-20269` and Veeam `CVE-2023-27532`. Researchers said Akira operators routinely stole credentials, moved laterally, established persistence, and attempted to evade defenses before either encrypting systems or stealing data for extortion. Sophos said Akira shifted notably toward **extortion-only** operations beginning in late 2023, exfiltrating data without always deploying ransomware. During intrusions, the actors dumped **LSASS**, extracted `NTDS.dit` and `SYSTEM` hives, targeted Veeam, browser, and KeePass credentials, and used tools including **Mimikatz, AdFind, Advanced IP Scanner, RDP, SMB, wmiexec, PsExec, AnyDesk, WinRAR, rclone, and MEGA**. The report also identified a previously unreported backdoor, **`crome.exe`**, communicating with `170.130.165[.]171`, alongside repeated efforts to disable Sophos and Microsoft Defender protections. When encryption was used, Akira deployed binaries such as `w.exe`, `Lck.exe`, `1.exe`, and `locker.exe`, appended the `.akira` extension, dropped `akira_readme.txt`, deleted Volume Shadow Copies, and in one case encrypted about 65,000 files on a server.
Aug 14, 2026