Veeam Backup & Replication exploit reused in new Frag ransomware attack

A critical flaw, tracked as CVE-2024-40711, in Veeam Backup & Replication (VBR) was also recently exploited to deploy Frag ransomware.

In mid-October, Sophos researchers warned that ransomware operators are exploiting the critical vulnerability CVE-2024-40711 in Veeam Backup & Replication to create rogue accounts and deploy malware.

In early September 2024, Veeam released security updates to address multiple vulnerabilities impacting its products, the company fixed 18 high and critical severity flaws in Veeam Backup & Replication, Service Provider Console, and One.

The most severe flaw included in the September 2024 security bulletin is a critical, remote code execution (RCE) vulnerability tracked as CVE-2024-40711 (CVSS v3.1 score: 9.8) impacting Veeam Backup & Replication (VBR).

Veeam Backup & Replication is a comprehensive data protection and disaster recovery software developed by Veeam. It enables organizations to back up, restore, and replicate data across physical, virtual, and cloud environments.

“A vulnerability allowing unauthenticated remote code execution (RCE).” reads the advisory.

Florian Hauser, cybersecurity researcher at CODE WHITE Gmbh, reported this vulnerability.

The flaw impacts Veeam Backup & Replication 12.1.2.172 and all earlier version 12 builds. 

Sophos X-Ops researchers observed recent attacks exploiting compromised credentials and Veeam vulnerability CVE-2024-40711 to deploy ransomware, including Fog and Akira. Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. Overlapping indicators link these cases to prior Fog and Akira ransomware attacks.

“Sophos X-Ops MDR and Incident Response are tracking a series of attacks in the past month leveraging compromised credentials and a known vulnerability in Veeam (CVE-2024-40711) to create an account and attempt to deploy ransomware.” reads a statement published by Sophos on Mastodon.

“In one case, attackers dropped Fog ransomware. Another attack in the same timeframe attempted to deploy Akira ransomware. Indicators in all 4 cases overlap with earlier Akira and Fog ransomware attacks. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Some of these VPNs were running unsupported software versions.”

Threat actors exploited the Veeam URI /trigger on port 8000 to spawn net.exe and create a local account, named “point,” adding it to the local Administrators and Remote Desktop Users groups. In one case, the attackers deployed Fog ransomware on an unprotected Hyper-V server and used rclone for data exfiltration.

Now, after the Akira and Fog ransomware attacks, experts warn of threat actors attempting to deploy Frag ransomware actively exploiting CVE-2024-40711.

Sophos recently found that a threat actor, tracked as STAC 5881, exploited CVE-2024-40711 to deploy Frag ransomware on compromised networks.

“The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881. Attacks leveraged compromised VPN appliances for access and used the VEEAM vulnerability to create a new local administrator account named “point”. Some cases in this cluster led to the deployment of Akira or Fog ransomware. Akira was first seen in 2023 and appears to be inactive since mid-October with its information leak site now offline.” reads a report published by Sophos. “In a recent case MDR analysts once again observed the tactics associated with STAC 5881 – but this time observed the deployment of a previously-undocumented ransomware called “Frag”.”

In a recent attack, threat group STAC 5881 accessed networks via a compromised VPN appliance, exploited a VEEAM vulnerability, and then created accounts named “point” and “point2.” The Frag ransomware, executed with encryption settings, added a *.frag extension to files but was ultimately blocked by Sophos’ CryptoGuard.

Researchers from cybersecurity firm Agger Labs also detailed the similarity in the tactics, techniques and practices of the actor behind Frag to those used by Akira and Fog threat actors.

“A key reason for Frag ransomware’s stealth is its reliance on LOLBins, a tactic widely adopted by more traditional threat actors. By using familiar, legitimate software already present within most networks, attackers can conduct malicious operations while bypassing endpoint detection systems.Whilst this is certainly not new in the threat actor space, it does show how ransomware crews are adapting their approaches.” states Agger Labs. “The use of LOLBins isn’t unique to Frag; ransomware strains like Akira and Fog have employed similar strategies, focusing on blending into normal network activity and hiding in plain sight. By using LOLBins, these operators exploit trusted software for malicious purposes, increasing the difficulty of timely detection.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Veeam Backup & Replication)