Threat hunts for Veeam
3 hunts covering Veeam, each with a hypothesis, the queries that test it and what the hunt cannot see.
3 hunts
-
critical Part 2 of 2Research by Unit 42
Virtualization Pivot and Host Encryption
The adversary has exploited a VPN gateway to breach the perimeter and is now pivoting to the virtualization layer to disable security controls and deploy ransomware via virtual disk manipulation.
6 query2 analytic1 checkpoint1 action2 taskCVE-2023-27532 · CVE-2026-0257 -
critical Part 1 of 2Research by Unit 42
VPN Gateway Exploitation and Unauthorized Authentication
An attacker has exploited CVE-2026-0257 on a PAN-OS gateway to bypass authentication and establish a VPN session, identifiable by suspicious client hostnames, MAC addresses, or PoC-specific user agents.
3 query1 analytic1 checkpoint1 action2 taskCVE-2023-27532 · CVE-2026-0257 -
mediumResearch by Huntress
Ransomware Recovery Inhibition and Encryption
An adversary is inhibiting system recovery by deleting volume shadow copies using standard tools or scripts before performing mass file encryption with rare extensions.
4 query1 analytic1 checkpoint1 action2 taskimpact