Hackers target Vulnerable Veeam Backup Servers exposed online

[CyberTech]

Content source

https://www.bleepingcomputer.com/news/security/hackers-target-vulnerable-veeam-backup-servers-exposed-online/

Veeam backup servers are being targeted by at least one group of threat actors known to work with multiple high-profile ransomware gangs.

Malicious activity and tools echoing FIN7 attacks have been observed in intrusions since March 28, less than a week after an exploit became available for a high-severity vulnerability in Veeam Backup and Replication (VBR) software.

Tracked as CVE-2023-27532, the security issue exposes encrypted credentials stored in the VBR configuration to unauthenticated users in the backup infrastructure. This could be used to access the backup infrastructure hosts.

The software vendor fixed the issue on March 7 and provided workaround instructions.

On March 23, Horizon3 pentesting company released an exploit for CVE-2023-27532, which also demonstrated how an unsecured API endpoint could be abused to extract the credentials in plain text. An attacker leveraging the vulnerability could also run code remotely with the highest privileges.

At the time, Huntress Labs warned that there were still approximately 7,500 internet-exposed VBR hosts that appeared to be vulnerable.

Full article

Hackers target vulnerable Veeam backup servers exposed online

Veeam backup servers are being targeted by at least one group of threat actors known to work with multiple high-profile ransomware gangs.

www.bleepingcomputer.com

 

[upnorth]

This vendor have had a bit too many issues over the years, and not the happy chappy ones. With this report it's around the 3rd time within one month.

Thanks for the share.