Huntress Reconstructs Intrusion Involving Veeam Exploitation and Suspected VPN Access
Summary
Huntress reconstructs an intrusion involving a successful account brute-force attack, credential theft through an unpatched Veeam service, WinRM lateral movement and persistence. VPN compromise is suspected, but telemetry was incomplete.
Key points
- Investigators observed a new local user added to administrator and Remote Desktop groups, along with registry changes to enable further RDP movement and bypass UAC.
- Process relationships traced the activity through wsmprovhost.exe, indicating lateral movement using WinRM.
- A PowerShell Operational log artifact showed a script used to retrieve credentials from a vulnerable Veeam service; the credentials were believed to enable code execution through the service.
- The installed Veeam Backup & Replication service was outdated and missing patches for CVE-2023-27532.
- A malicious workstation name appeared in logs during a roughly two-minute brute-force attack against several accounts; the attack succeeded against one account.
- A machine name containing “nmap” suggested possible scanning, but the evidence was circumstantial and did not establish that Veeam was specifically targeted.
- VPN compromise was considered the likely initial access vector, but available VPN telemetry showed a logout rather than definitive login evidence.
Article Details
- Attack Vectors
- A brute-force attack against user accounts succeeded and compromised credentials.
- The threat actor used credentials to access a system running an unpatched Veeam Backup & Replication service and exploited CVE-2023-27532 to retrieve credentials and obtain code execution.
- The threat actor moved laterally through the environment using WinRM.
- The threat actor created a local user, added it to local administrator and Remote Desktop Users groups, and modified registry settings to enable further RDP lateral movement and bypass UAC.
- VPN compromise is strongly suspected as the initial access vector, but the article states that evidence is circumstantial and incomplete.
- Defensive Notes
- Patch the Veeam Backup & Replication service; the investigated installation was out of date and missing patches.
- Review process parent-child relationships, including processes spawned by wsmprovhost.exe and Veeam.Backup.MountService.exe.
- Monitor for brute-force attempts, anomalous account and group changes, and registry modifications related to RDP or UAC.
- Review WinRM activity and authentication events, while accounting for incomplete or ambiguous telemetry.
MITRE ATT&CK
T1021.006 · Windows Remote ManagementProcess lineage from wsmprovhost.exe indicated lateral movement using WinRM.T1098 · Account ManipulationThe threat actor created a local user and added it to local administrator and Remote Desktop Users groups.T1110 · Brute ForceA brute-force attack targeted several user accounts and successfully compromised one account.T1112 · Modify RegistryThe threat actor modified registry settings to facilitate RDP lateral movement and bypass UAC.T1133 · External Remote ServicesVPN compromise is strongly suspected as initial access, although the article reports only circumstantial VPN telemetry.
CVE
People
Anton OvrutskyNamed as an author of the Huntress investigation write-up.Dray AghaNamed as an author of the Huntress investigation write-up.Josh AllmanNamed as an author of the Huntress investigation write-up.Lina LauSecurity researcher whose blog is cited for explaining authentication events containing “ANONYMOUS LOGON.”
Products
Microsoft WindowsAlthough there are a myriad of ways to create a user on a Windows host and add that user to a particular group, if these actions were performed in a normal fashion by a systems administrator, the process lineage wouldVeeam Backup & Replicationinformation, the affected victim host was enumerated further to see if a vulnerable version of Veeam Backup & Replication existed. Sure enough, we found that the installed service was out of date and missing patches.