Critical Veeam RCE bug now used in Frag ransomware attacks

A critical unauthenticated deserialization RCE in Veeam Backup & Replication (CVE-2024-40711) has been actively exploited in the wild—initially by Akira and Fog ransomware operators and more recently by a cluster deploying 'Frag' ransomware—often combined with stolen VPN gateway credentials to create administrative accounts on unpatched, internet-exposed VBR servers; coordinated disclosure and delayed PoC release were used to allow patching, but exploitation continued and poses high risk given Veeam's widespread use.