New Ransomware Group Exploiting Veeam Backup Software Vulnerability

Group-IB and other vendors observed active exploitation of a patched Veeam Backup & Replication vulnerability (CVE-2023-27532) by ransomware groups (EstateRansomware and Akira). Attackers gained access via a dormant FortiGate SSL VPN account, moved laterally to a failover/backup server, deployed a persistent backdoor (svchost.exe), enabled xp_cmdshell to create a 'VeeamBkp' account, harvested credentials, disabled Windows Defender, exfiltrated data, and deployed ransomware—demonstrating a high-impact supply-side attack against backup infrastructure.