# Ransomware Targeting of Backup Infrastructure: Akira/Fog/Frag Exploiting Veeam CVE-2024-40711, Plus CVE-2025-23120 and March 2026 Backup & Replication Flaws (CVE-2026-21666/21667/21708)

> Ransomware operators increasingly attack backup storage. Sophos X-Ops observed Akira, Fog and Frag ransomware attacks that combined compromised VPN access with Veeam Backup & Replication CVE-2024-40711 (CVSS 9.8, CISA KEV) to create local admin accounts and deploy ransomware. Further critical Backup & Replication flaws followed (CVE-2025-23120 and the March 2026 batch), and Rubrik and ReversingLabs now scan backup snapshots for ransomware indicators.

- **Published:** 2026-10-31T06:49:33Z
- **Last reviewed:** 2026-10-31T06:49:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4885
- **ID:** TL-2026-4885
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-40711, CVE-2025-23120, CVE-2026-21666, CVE-2026-21667, CVE-2026-21708

## Description

CVE-2024-40711 is a deserialization-of-untrusted-data flaw in Veeam Backup & Replication (VBR) that allows remote code execution. It was patched on 2024-09-04 in VBR 12.2 (build 12.2.0.334) and affects VBR 12.1.2.172 and earlier version 12 builds. watchTowr Labs (2024-09-09) showed the root cause lies in the .NET Remoting services, which run as NT AUTHORITY\SYSTEM. The whitelisted class CDbCryptoKeyInfo deserializes a nested payload through CProxyBinaryFormatter in blacklist mode, which bypasses the RestrictedSerializationBinder. The System.Runtime.Remoting.ObjRef gadget is then executed. On builds up to 12.1.0.2131 an authorization check returned true, so exploitation was unauthenticated. On 12.1.1.56 through 12.1.2.172 it needs authentication. A public proof-of-concept appeared on 2024-09-15.

Sophos X-Ops MDR and Incident Response (reported 2024-10-10) tracked attacks in which adversaries first logged in through compromised VPN gateways that lacked multi-factor authentication, some running outdated software. They then exploited CVE-2024-40711 on the Veeam server to create a local administrator account named 'point' and deployed Akira or Fog ransomware, with data exfiltration via rclone. Sophos later documented a previously undocumented ransomware, Frag, deployed in the same way (account 'point' plus 'point2'; encrypted files get the .frag extension; the binary takes a required file-encryption-percentage parameter). Sophos CryptoGuard blocked Frag. The activity is tracked as threat cluster STAC 5881. CISA added CVE-2024-40711 to the KEV catalog on 2024-10-17, with known ransomware campaign use.

Follow-on VBR flaws keep backup servers a high-value target. CVE-2025-23120 (found by Piotr Bazydlo of watchTowr; fixed in build 12.3.1.1139 on 2025-03-20) is a deserialization RCE for authenticated domain users on domain-joined backup servers. It abuses gadgets missing from Veeam's blocklist. The March 2026 Veeam advisory (KB4830) fixed CVE-2026-21666 and CVE-2026-21667 (authenticated domain user RCE on the Backup Server, CVSS 9.9) and CVE-2026-21708 (Backup Viewer RCE as the postgres user, CVSS 9.9) in 12.3.2.4465 (12.3.2.4165 and earlier version 12 builds are affected; 21708 is also fixed in 13.0.1.2067). No exploitation in the wild was stated for the 2025 and 2026 CVEs in the reviewed sources.

The ReversingLabs blog (2026-09-10) frames the defensive side. It cites Rubrik research that 96% of ransomware attacks target backup storage. In 94% of cases where organizations were hit, attackers attempted to compromise backups, and 57% of those attempts succeeded. Organizations with compromised backups were 63% more likely to suffer encryption, with median recovery cost of $3M versus $375K with intact backups. Rubrik Threat Monitoring and Threat Hunting incorporate the ReversingLabs ransomware feed (SHA-1/MD5/SHA-256 hashes with MITRE ATT&CK mapping) to scan backup snapshots and find clean recovery points. The article provides no IOCs or version numbers, and no network IOCs were available for BeaconBeagle correlation.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1136.001 Local Account
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery

## Sources

- [Rubrik + RL: Bring Threat Intelligence and Detection to Backups](https://www.reversinglabs.com/blog/rubrik-rl-threat-intelligence-ransomware-backups)
- [Sophos: Veeam exploit seen used again with a new ransomware, Frag](https://www.sophos.com/en-us/news/veeam-exploit-seen-used-again-with-a-new-ransomware-frag)
- [BleepingComputer: Akira and Fog ransomware now exploiting critical Veeam RCE flaw](https://www.bleepingcomputer.com/news/security/akira-and-fog-ransomware-now-exploiting-critical-veeam-rce-flaw/)
- [watchTowr Labs: Veeam Backup & Response RCE (CVE-2024-40711) analysis](https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/)
- [Help Net Security: Critical Veeam Backup & Replication RCE fixed (CVE-2025-23120)](https://www.helpnetsecurity.com/2025/03/20/critical-veeam-backup-replication-rce-vulnerability-cve-2025-23120/)
- [Veeam KB4830: Vulnerabilities resolved in Backup & Replication 12.3.2.4465](https://veeam.com/kb4830)
- [The Hacker News: Veeam patches 7 critical Backup & Replication flaws](https://thehackernews.com/2026/03/veeam-patches-7-critical-backup.html)
- [Security Affairs: CISA adds Veeam Backup and Replication flaw to KEV catalog](https://securityaffairs.com/170014/SECURITY/U-S-CISA-ADDS-VEEAM-BACKUP-AND-REPLICATION-FLAW-TO-ITS-KNOWN-EXPLOITED-VULNERABILITIES-CATALOG.HTML)
- [The Record: Veeam vulnerability exploited in ransomware attacks, CISA KEV](https://therecord.media/veam-vulnerability-exploited-ransomware-cisa-kev)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4885