# Untold Tales from Tactical Response

Attacker brute-forced an account, exploited unpatched Veeam Backup service to dump credentials, then moved laterally via WinRM and created a persistent admin user.

- Payout: Real-world hack
- Severity: high
- Program: Veeam Backup
- Analysis by: Huntress
- Disclosed: 2025-03-10
- CVE: CVE-2023-27532
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/untold-tales-from-tactical-response
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-untold-tales-from-tactical-response
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:default-creds vuln:auth-bypass vuln:privilege-escalation vuln:secrets-leak

**Target:** Veeam.Backup.MountService.exe on Windows host
**Root cause:** Outdated, unpatched Veeam Backup & Replication service allowed credential extraction from the Veeam service; combined with weak account passwords enabling brute force.
**Steps:**
1. Brute force internal user accounts from a malicious workstation (~2 minutes) until one account is compromised.
2. Use compromised credentials to access a host running an outdated Veeam Backup & Replication service.
3. Run a PowerShell script (logged in event ID 4104) exploiting CVE-2023-27532 to pull credentials from the Veeam service.
4. Use extracted credentials to gain code execution via the vulnerable Veeam service, spawning commands from Veeam.Backup.MountService.exe.
5. Create a new local user, add to Administrators and Remote Desktop Users groups via `net localgroup Administrators <user> /add`.
6. Modify registry to enable RDP lateral movement and bypass UAC.
7. Move laterally via WinRM (wsmprovhost.exe spawning commands).
**How found:** Analyst noticed registry and user-creation commands spawning from wsmprovhost.exe (WinRM), traced parent processes to Veeam.Backup.MountService.exe, found a PowerShell script in event ID 4104 exploiting CVE-2023-27532, then pivoted on a known malicious workstation name to find brute-force events and ANONYMOUS LOGON authentications from an nmap-named host.
**Exploitation:** Initial access likely via VPN appliance compromise; attacker brute-forced an internal account, used it to reach a host with unpatched Veeam, ran a PowerShell credential-dumping script against CVE-2023-27532, then used stolen credentials to execute commands through the Veeam service and pivot via WinRM.
**Escalation:** Credential theft from Veeam service enabled administrative access, persistence via new local admin account, and further lateral movement via RDP/WinRM.
**Insight:** Trace parent-child process lineage of registry/user-creation commands: unexpected parents like wsmprovhost.exe or Veeam.Backup.MountService.exe reveal lateral movement and exploited services; also pivot on workstation names and ANONYMOUS LOGON events to find scanning and brute force.

## Write-ups of the same bug (oldest first)
- 2023-03-13: [Veeam Backup & Replication CVE-2023-27532 Response](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-veeam-backup-replication-cve-2023-27532-response) — Huntress
- 2025-03-10: [Untold Tales from Tactical Response](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-untold-tales-from-tactical-response) — Huntress (this one)