Threat reportRansomwareTL-2026-4885
Ransomware Targeting of Backup Infrastructure: Akira/Fog/Frag Exploiting Veeam CVE-2024-40711, Plus CVE-2025-23120 and March 2026 Backup & Replication Flaws (CVE-2026-21666/21667/21708)
Ransomware Targeting of Backup Infrastructure (TL-2026-4885), also tracked as Veeam backup server ransomware campaign, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-10-31. It is attributed to Akira with medium confidence, affects Veeam Backup & Replication, references 5 CVEs (CVE-2024-40711, CVE-2025-23120, CVE-2026-21666), maps to 6 MITRE ATT&CK techniques (T1078, T1133, T1136.001), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 3Akira
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4885
- Threat ID
- TL-2026-4885
- Also known as
- Veeam backup server ransomware campaign, STAC 5881
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Akira, Fog, Frag ransomware operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- all sectors using veeam backup replication, enterprise it
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Ransomware Targeting of Backup Infrastructure
Malware and tooling: Akira, fog, frag, Rclone - S1040
How Ransomware Targeting of Backup Infrastructure works
Ransomware operators increasingly attack backup storage. Sophos X-Ops observed Akira, Fog and Frag ransomware attacks that combined compromised VPN access with Veeam Backup & Replication CVE-2024-40711 (CVSS 9.8, CISA KEV) to create local admin accounts and deploy ransomware. Further critical Backup & Replication flaws followed (CVE-2025-23120 and the March 2026 batch), and Rubrik and ReversingLabs now scan backup snapshots for ransomware indicators.
CVE-2024-40711 is a deserialization-of-untrusted-data flaw in Veeam Backup & Replication (VBR) that allows remote code execution. It was patched on 2024-09-04 in VBR 12.2 (build 12.2.0.334) and affects VBR 12.1.2.172 and earlier version 12 builds. watchTowr Labs (2024-09-09) showed the root cause lies in the .NET Remoting services, which run as NT AUTHORITY\SYSTEM. The whitelisted class CDbCryptoKeyInfo deserializes a nested payload through CProxyBinaryFormatter in blacklist mode, which bypasses the RestrictedSerializationBinder. The System.Runtime.Remoting.ObjRef gadget is then executed. On builds up to 12.1.0.2131 an authorization check returned true, so exploitation was unauthenticated. On 12.1.1.56 through 12.1.2.172 it needs authentication. A public proof-of-concept appeared on 2024-09-15.
Sophos X-Ops MDR and Incident Response (reported 2024-10-10) tracked attacks in which adversaries first logged in through compromised VPN gateways that lacked multi-factor authentication, some running outdated software. They then exploited CVE-2024-40711 on the Veeam server to create a local administrator account named 'point' and deployed Akira or Fog ransomware, with data exfiltration via rclone. Sophos later documented a previously undocumented ransomware, Frag, deployed in the same way (account 'point' plus 'point2'; encrypted files get the .frag extension; the binary takes a required file-encryption-percentage parameter). Sophos CryptoGuard blocked Frag. The activity is tracked as threat cluster STAC 5881. CISA added CVE-2024-40711 to the KEV catalog on 2024-10-17, with known ransomware campaign use.
Follow-on VBR flaws keep backup servers a high-value target. CVE-2025-23120 (found by Piotr Bazydlo of watchTowr; fixed in build 12.3.1.1139 on 2025-03-20) is a deserialization RCE for authenticated domain users on domain-joined backup servers. It abuses gadgets missing from Veeam's blocklist. The March 2026 Veeam advisory (KB4830) fixed CVE-2026-21666 and CVE-2026-21667 (authenticated domain user RCE on the Backup Server, CVSS 9.9) and CVE-2026-21708 (Backup Viewer RCE as the postgres user, CVSS 9.9) in 12.3.2.4465 (12.3.2.4165 and earlier version 12 builds are affected; 21708 is also fixed in 13.0.1.2067). No exploitation in the wild was stated for the 2025 and 2026 CVEs in the reviewed sources.
The ReversingLabs blog (2026-09-10) frames the defensive side. It cites Rubrik research that 96% of ransomware attacks target backup storage. In 94% of cases where organizations were hit, attackers attempted to compromise backups, and 57% of those attempts succeeded. Organizations with compromised backups were 63% more likely to suffer encryption, with median recovery cost of $3M versus $375K with intact backups. Rubrik Threat Monitoring and Threat Hunting incorporate the ReversingLabs ransomware feed (SHA-1/MD5/SHA-256 hashes with MITRE ATT&CK mapping) to scan backup snapshots and find clean recovery points. The article provides no IOCs or version numbers, and no network IOCs were available for BeaconBeagle correlation.
MITRE ATT&CK techniques used in TL-2026-4885
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
Impact
Exfiltration
Affected products and versions in Ransomware Targeting of Backup Infrastructure
- Veeam — Backup & Replication
Vulnerable versions: 12.1.2.172 and earlier version 12 builds (CVE-2024-40711); 12.3.0.310 and earlier version 12 builds, domain-joined servers only (CVE-2025-23120); 12.3.2.4165 and earlier version 12 builds (CVE-2026-21666, CVE-2026-21667, CVE-2026-21708)
Fixed in: 12.2.0.334; 12.3.1.1139; 12.3.2.4465; 13.0.1.2067 (CVE-2026-21708)
Remediation for Ransomware Targeting of Backup Infrastructure
Patches
- Veeam Backup & Replication 12.2.0.334 or later (CVE-2024-40711)
- Veeam Backup & Replication 12.3.1.1139 (CVE-2025-23120)
- Veeam Backup & Replication 12.3.2.4465 or 13.0.1.2067 (March 2026 flaws, KB4830)
Immediate actions
- Patch Veeam Backup & Replication to the current fixed build; CVE-2024-40711 is fixed in 12.2.0.334 or later, CVE-2025-23120 in 12.3.1.1139 or later, and the March 2026 flaws in 12.3.2.4465 or 13.0.1.2067
- Require MFA on all VPN gateways and update or retire unsupported VPN software
- Audit Veeam servers for unexpected local administrator accounts such as 'point' and 'point2'
- Do not expose Veeam services to the internet
Workarounds
- Restrict network access to Veeam services to management hosts only
- Limit domain user and Backup Viewer roles on domain-joined backup servers until patched
Longer-term hardening
- Remove the backup server from the production Active Directory domain or isolate it in a separate management domain
- Keep immutable or offline backup copies
- Scan backup snapshots for ransomware indicators before restore (for example Rubrik Threat Monitoring with the ReversingLabs ransomware feed)
- Monitor for rclone and bulk data staging on backup servers
CVEs associated with Ransomware Targeting of Backup Infrastructure
CVE-2024-40711, CVE-2025-23120, CVE-2026-21666, CVE-2026-21667, CVE-2026-21708
Weaknesses (CWE) in Ransomware Targeting of Backup Infrastructure
Timeline of Ransomware Targeting of Backup Infrastructure
- Veeam released patches for CVE-2024-40711 (fixed in Backup & Replication 12.2.0.334)
- watchTowr Labs published a technical analysis of the CVE-2024-40711 deserialization chain (CDbCryptoKeyInfo/ObjRef)
- Proof-of-concept exploit code for CVE-2024-40711 was released publicly
- Sophos X-Ops reported Akira and Fog ransomware attacks using compromised VPN credentials and CVE-2024-40711 to create the local admin account 'point'
- CISA added CVE-2024-40711 to the Known Exploited Vulnerabilities catalog
- Veeam fixed CVE-2025-23120 (domain-user RCE on domain-joined servers) in build 12.3.1.1139; discovered by watchTowr Labs
- Veeam published KB4830 fixing CVE-2026-21666, CVE-2026-21667 and CVE-2026-21708 (CVSS 9.9) in 12.3.2.4465
- ReversingLabs published the Rubrik integration post on ransomware targeting of backups and snapshot scanning with the RL ransomware feed
Sources cited for Ransomware Targeting of Backup Infrastructure
- Rubrik + RL: Bring Threat Intelligence and Detection to Backups
- Sophos: Veeam exploit seen used again with a new ransomware, Frag
- BleepingComputer: Akira and Fog ransomware now exploiting critical Veeam RCE flaw
- watchTowr Labs: Veeam Backup & Response RCE (CVE-2024-40711) analysis
- Help Net Security: Critical Veeam Backup & Replication RCE fixed (CVE-2025-23120)
- Veeam KB4830: Vulnerabilities resolved in Backup & Replication 12.3.2.4465
- The Hacker News: Veeam patches 7 critical Backup & Replication flaws
- Security Affairs: CISA adds Veeam Backup and Replication flaw to KEV catalog
- The Record: Veeam vulnerability exploited in ransomware attacks, CISA KEV
Detection coverage for TL-2026-4885
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4885 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.