Loading story…
Attackers began actively probing NAKIVO Backup & Replication for CVE-2024-48248, an unauthenticated arbitrary file-read vulnerability that was publicly disclosed in September 2024 and later detailed with proof-of-concept research by watchTowr. MBSD-SOC reported first seeing exploitation attempts on 2025-02-27, with activity continuing into March, indicating that the flaw had moved from public disclosure into observed attack traffic against exposed systems.
One observed request targeted the /c/router endpoint with the STPreLoadManagement action and getImageByPath method to retrieve /etc/passwd, a common check used to confirm arbitrary file access on Linux hosts. MBSD-SOC said many of the attack sources it saw were located in France, while NAKIVO release notes indicate fixes are available, prompting defenders to urgently update affected installations to the latest patched version and review internet-exposed backup infrastructure for signs of compromise.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
After first being seen in late February, exploitation activity against vulnerable NAKIVO Backup & Replication systems continued into March 2025. MBSD-SOC said many observed attack sources were located in France.
MBSD-SOC reported first seeing attacks targeting CVE-2024-48248 on this date. One observed attempt used a POST request to "/c/router" with the "STPreLoadManagement" action and "getImageByPath" method to try reading "/etc/passwd".
The arbitrary file-read vulnerability CVE-2024-48248 in NAKIVO Backup & Replication was publicly disclosed. The flaw can allow unauthenticated attackers to read arbitrary files if exploited.
Public proof-of-concept exploit code for CVE-2024-48248 was available by the time of the reporting. This lowered the barrier to exploitation of the NAKIVO flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcelabs.watchtowr.com
Open sourcehelpcenter.nakivo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed and patched **`CVE-2024-24919`**, a critical information disclosure flaw affecting Internet-connected **Network Security Gateway** devices with **Remote Access VPN** or **Mobile Access** enabled. The vulnerability was traced to improper HTTP `POST` request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately. Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as `ntds.dit`, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Jul 24, 2026
Multiple ransomware groups have been exploiting a critical authentication bypass in **Veeam Backup & Replication**, identified as **`CVE-2024-40711`**, to gain access to backup infrastructure and deploy ransomware. Reporting tied the activity to at least one newly observed ransomware operation, with attackers abusing the flaw to compromise internet-exposed Veeam servers, move deeper into victim environments, and target backup systems that are often central to recovery efforts. The vulnerability affects domain-joined Veeam Backup & Replication servers, and successful exploitation can allow remote code execution under certain conditions. Security reporting said the bug was being used in real-world intrusions shortly after disclosure, underscoring the risk to organizations that rely on Veeam for business continuity. Defenders were urged to patch affected systems, restrict external exposure of backup management interfaces, and monitor Veeam infrastructure for signs of unauthorized access or ransomware deployment.
Jul 12, 2026
Veeam has released fixes for a critical remote code execution flaw in **Veeam Backup & Replication**, tracked as `CVE-2026-44963`, affecting version `12.3.2.4465` and earlier `12.x` builds on **Windows domain-joined** servers. The vulnerability was reported by WatchTowr researcher **Sina Kheirkhah** and allows any **authenticated low-privileged domain user** to execute arbitrary code on the backup server, giving attackers a path to compromise backup infrastructure in Active Directory environments. Veeam says **version 13.x is not affected** because of architectural changes, and the issue is resolved in **Veeam Backup & Replication `12.3.2.4854`**. The flaw has not been publicly reported as exploited, but Veeam warned that attackers often reverse-engineer patches quickly to target unpatched systems. The issue carries a **CVSS v4 score of 9.4** and is especially serious because backup servers are frequent ransomware targets: compromising them can enable **data theft, lateral movement, privilege escalation, and destruction of backups**. Reporting on the disclosure also pointed to earlier Veeam-focused attacks, including abuse of `CVE-2024-40711` by **Akira, Fog, and Frag**, underscoring the need for organizations to patch immediately, review domain-joined deployments, restrict unnecessary domain user access, and closely monitor backup infrastructure.
Jul 23, 2026