Akira and Fog ransomware now exploit critical Veeam RCE flaw

A critical deserialization RCE vulnerability (CVE-2024-40711) in Veeam Backup & Replication was disclosed and patched in September; proof-of-concept code was released after a delay but attackers quickly weaponized the flaw. Sophos X-Ops observed Akira and Fog ransomware deployments leveraging the Veeam flaw alongside compromised VPN credentials to create local admin accounts and exfiltrate backups (rclone), and the report notes prior Veeam exploits used by financially motivated groups.