You had a year to patch this Veeam flaw and now it's going to hurt

EstateRansomware is an emerging ransomware group observed exploiting an unpatched Veeam Backup & Replication vulnerability (CVE-2023-27532) to gain control of backup servers and deploy a LockBit 3.0 variant. Analysts describe initial access via brute-forced FortiGate SSL VPN credentials (a dormant 'Acc1' account), remote desktop-based lateral movement into Veeam failover and file servers, credential harvesting with tools like SoftPerfect Netscan and Nirsoft, and exploitation using publicly available proof-of-concept code. The intruders then escalate access to Active Directory, disable Windows Defender, clear logs and encrypt files, underscoring the critical need for timely patching and credential hygiene.