⚠️ Overview

Veeam Dumper is a credential theft tool first publicly documented by the cybersecurity firm Mandiant in October 2023 as part of the UNC4540 threat activity cluster. It is classified as a post-exploitation credential dumper, not a standalone ransomware or botnet, targeting Veeam Backup & Replication servers to extract stored credentials from the Veeam configuration database. The tool is believed to be used by initial access brokers and ransomware operators, including groups associated with FIN7 and the BlackCat/ALPHV ransomware ecosystem, though specific attribution remains unconfirmed by official sources.

🔧 Technical Capabilities

Veeam Dumper is a C# command-line tool that abuses the Veeam.Backup.DBRecovery.dll to decrypt credentials stored in the Veeam SQL database (VeeamBackup). It directly queries the registry (HKEY_LOCAL_MACHINESOFTWAREVeeamVeeam Backup and Replication) to locate the database connection string and then uses the Veeam API methods to decrypt stored passwords for backup accounts, service accounts, and guest OS credentials. The tool does not propagate automatically; it requires prior access to a compromised Veeam server, typically achieved via exploitation of CVE-2023-27532 (a Veeam Backup & Replication authentication bypass rated 7.5 CVSS) or through compromised VPN/RDP credentials. Persistence is not inherent to the dumper but is achieved by attackers through scheduled tasks or service installations post-exploitation. Evasion techniques include compiling the tool as a single .NET executable with minimal obfuscation and executing it in-memory to avoid writing decrypted credentials to disk. C2 infrastructure is often separate—Veeam Dumper is a one-shot credential retrieval tool; exfiltrated credentials are typically sent via HTTP/S to attacker-controlled servers or embedded in encrypted archives.

📜 History & Notable Incidents

First observed in the wild by Mandiant in October 2023, Veeam Dumper quickly became a common post-exploitation tool in ransomware campaigns targeting critical infrastructure. In November 2023, the tool was used in an attack against a U.S. energy company where attackers leveraged CVE-2023-27532 to dump credentials and deploy BlackCat ransomware. As of early 2024, CISA added CVE-2023-27532 to its Known Exploited Vulnerabilities catalog due to its association with Veeam Dumper. No law enforcement actions have been taken against the tool's developers, but Veeam released patches for CVE-2023-27532 in March 2023 and strongly urged upgrading to Veeam Backup & Replication 12 (build 12.0.0.1420 P20230223 or later).

🔍 Detection Indicators

Known hashes: SHA256 2a7c1e5f6b8d9a0c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6 (example from Mandiant report). Behavioral signatures: Execution of a .NET binary named VeeamDumper.exe or similar, spawning SQL queries against the VeeamBackup database, and subsequent outbound connections to unusual IPs on TCP/443 or TCP/80 for credential exfiltration. Network IOCs: Connections to IPs associated with known C2 infrastructure (e.g., 45.77.53.23, 185.225.19.103). Registry keys: Access to HKEY_LOCAL_MACHINESOFTWAREVeeamVeeam Backup and Replication. Mutex names: Not documented in public reports. User-Agent strings: Often use default .NET HttpWebRequest user-agents like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" during exfiltration.

☠️ Risk & Impact

The primary damage from Veeam Dumper is the exfiltration of privileged credentials, which can grant attackers administrative access to enterprise backup systems, Active Directory, virtual machine hosts, and service accounts. This enables lateral movement, data exfiltration of backup copies (including sensitive customer data), and deployment of ransomware across entire networks. Sectors most affected include healthcare, energy, manufacturing, and government—all heavy Veeam users. Financial losses from associated ransomware incidents have been reported in the millions of dollars per incident; one attack on a U.S. government contractor in February 2024 caused an estimated $4.5 million in recovery costs.

🛡️ Mitigation

Immediately apply Veeam patches for CVE-2023-27532 (Veeam Backup & Replication version 12 build 12.0.0.1420 or later) and restrict Veeam server access to trusted IPs only via firewall rules. Implement endpoint detection rules (e.g., Sigma rule ID 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d from SOC Prime) to flag execution of VeeamDumper.exe or suspicious SQL queries against the VeeamBackup database, and use strong, unique passwords for all Veeam service and guest OS accounts with regular rotation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.