Veeam — CraftedSignal Threat Feed

Multiple Critical Vulnerabilities in Veeam Backup & Replication Allow Remote Code Execution

hello@craftedsignal.io — Sat, 14 Mar 2026 10:00:00 +0000

On March 13, 2026, the Centre for Cybersecurity Belgium (CCB) issued an advisory regarding multiple critical vulnerabilities affecting Veeam Backup & Replication versions 12.3.2.4165 and earlier, as well as version 13.0.1.1071. These vulnerabilities, including CVE-2026-21666, CVE-2026-21668, CVE-2026-21669, CVE-2026-21670, CVE-2026-21671, CVE-2026-21672, and CVE-2026-21708, can be exploited by authenticated domain users or low-privileged users to achieve remote code execution, bypass…

Potential Veeam Credential Access via SQL Commands

hello@craftedsignal.io — Wed, 03 Jul 2024 12:00:00 +0000

Attackers are increasingly targeting backup infrastructure to maximize the impact of ransomware and data exfiltration attacks. Veeam, a popular backup and disaster recovery solution, stores credentials for backup operations in MSSQL databases. An attacker who gains access to these databases may attempt to use tools like sqlcmd.exe or PowerShell commands (e.g., Invoke-Sqlcmd) to extract and decrypt these credentials. This tactic allows the attacker to compromise the backups themselves, preventing recovery and increasing pressure on the victim. This activity has been observed in real-world incidents, such as those involving the Diavol ransomware. Defenders should monitor for suspicious command-line activity targeting Veeam credentials within MSSQL environments.

Attack Chain

Initial access to the target environment is gained through methods such as phishing or exploiting a vulnerability in a public-facing application.
The attacker performs reconnaissance to identify the location of the Veeam MSSQL database server.
The attacker obtains valid credentials or exploits a vulnerability to gain access to the Veeam MSSQL database server.
The attacker executes sqlcmd.exe or uses PowerShell commands (e.g., Invoke-Sqlcmd) to query the [VeeamBackup].[dbo].[Credentials] table.
The attacker retrieves the encrypted Veeam credentials from the database.
The attacker decrypts the Veeam credentials using custom scripts or tools, potentially leveraging the Veeam backup server itself.
The attacker uses the compromised Veeam credentials to access and delete or encrypt backup data.
The attacker deploys ransomware on the remaining systems, knowing that recovery from backups is now impossible.

Impact

Successful compromise of Veeam credentials can have devastating consequences. Attackers can encrypt or delete backup data, making recovery impossible and significantly increasing the impact of ransomware attacks. This can lead to prolonged downtime, data loss, financial losses, and reputational damage. Organizations relying on Veeam for backup and recovery should prioritize monitoring and securing their Veeam infrastructure to prevent credential access and backup compromise.

Recommendation

Enable Sysmon process creation logging to capture command-line activity, specifically sqlcmd.exe and PowerShell.
Deploy the Sigma rule “Potential Veeam Credential Access Command” to detect suspicious command executions targeting Veeam credentials in MSSQL databases.
Review and restrict access controls to the Veeam MSSQL database, ensuring only authorized personnel and services have access.
Monitor for unusual login activity and failed login attempts to the Veeam MSSQL database server.
Implement multi-factor authentication for all accounts with access to Veeam infrastructure.
Regularly audit Veeam backup configurations and logs to identify any unauthorized modifications or access attempts.

Veeam Backup Library Loaded by Unusual Process

hello@craftedsignal.io — Fri, 03 May 2024 14:22:00 +0000

This detection identifies potential credential compromise attempts targeting Veeam Backup software. Attackers may attempt to load the Veeam.Backup.Common.dll library through unauthorized processes, such as PowerShell or unsigned executables, to decrypt and misuse stored credentials. These credentials can then be used to target backups, potentially leading to destructive operations like ransomware attacks. The rule focuses on flagging untrusted or unsigned processes loading the Veeam library, providing an indicator of possible malicious activity. The detection logic specifically looks for scenarios where PowerShell or other unusual processes load the Veeam backup library, which deviates from typical administrative or backup-related operations. This activity warrants further investigation to determine if it’s part of a credential access attempt.

Attack Chain

An attacker gains initial access to a Windows system through unspecified means.
The attacker uses PowerShell (powershell.exe, pwsh.exe, powershell_ise.exe) or another unsigned process to execute malicious commands.
The malicious process attempts to load the Veeam.Backup.Common.dll library.
The Veeam.Backup.Common.dll library is loaded into the process memory.
The attacker leverages the loaded library to decrypt stored Veeam credentials.
Using the decrypted credentials, the attacker gains access to Veeam backups.
The attacker may then encrypt, delete, or exfiltrate the backups, leading to data loss or ransomware attacks.
The attacker pivots to other systems using the compromised credentials, further expanding the attack.

Impact

Successful exploitation allows attackers to gain access to sensitive Veeam backup data. This can lead to data exfiltration, data encryption, or complete data loss. The impact includes potential ransomware attacks, significant business disruption, and financial losses due to recovery efforts and downtime. The compromise of Veeam backups can severely impact an organization’s ability to recover from incidents, making it a critical target for attackers.

Recommendation

Deploy the Sigma rule “Veeam Backup Library Loaded by Unusual Process” to your SIEM to detect suspicious DLL loads (rule.name).
Investigate any alerts generated by the Sigma rule, focusing on the process details and execution history to determine legitimacy (rule.description).
Enable process creation and library load logging to capture the necessary events for the Sigma rule to function correctly.
Review and enforce code signing policies to prevent unsigned processes from loading critical libraries like Veeam.Backup.Common.dll.
Implement multi-factor authentication for Veeam accounts to mitigate the impact of credential compromise.