{"id":4716,"date":"2025-06-11T09:19:37","date_gmt":"2025-06-11T09:19:37","guid":{"rendered":"https:\/\/www.netboss.nl\/uncategorized\/domain-compromise-via-veeam-a-leak-no-one-saw-coming\/"},"modified":"2025-06-12T08:59:33","modified_gmt":"2025-06-12T08:59:33","slug":"domain-compromise-via-veeam-a-leak-no-one-saw-coming","status":"publish","type":"post","link":"http:\/\/www.netboss.nl\/en\/blogs-en\/domain-compromise-via-veeam-a-leak-no-one-saw-coming\/","title":{"rendered":"Domain compromise via Veeam: a leak no one saw coming"},"content":{"rendered":"<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1248px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1\"><h3><span style=\"font-weight: 400;\">Strong passwords? Too bad. This Veeam vulnerability bypasses everything.  <\/span><\/h3>\n<p><strong>Strong password? Check. Up-to-date systems? Check. But what if your backup software itself is the leak? CVE-2023-27532 shows that you need more than best practices.     <\/strong><\/p>\n<h2><b>Recognize the problem<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">NodeZero found a vulnerable Veeam installation. Consequence: <\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">7 accounts compromised<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">access to domain admin<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">complete credential dump<\/span><\/li>\n<\/ul>\n<\/div><div class=\"fusion-image-element \" style=\"--awb-caption-title-font-family:var(--h2_typography-font-family);--awb-caption-title-font-weight:var(--h2_typography-font-weight);--awb-caption-title-font-style:var(--h2_typography-font-style);--awb-caption-title-size:var(--h2_typography-font-size);--awb-caption-title-transform:var(--h2_typography-text-transform);--awb-caption-title-line-height:var(--h2_typography-line-height);--awb-caption-title-letter-spacing:var(--h2_typography-letter-spacing);\"><span class=\" fusion-imageframe imageframe-none imageframe-1 hover-type-none\"><img decoding=\"async\" width=\"1200\" height=\"465\" title=\"domain-compromise\" src=\"http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise.jpg\" data-orig-src=\"http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise.jpg\" alt class=\"lazyload img-responsive wp-image-4700\" srcset=\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%271200%27%20height%3D%27465%27%20viewBox%3D%270%200%201200%20465%27%3E%3Crect%20width%3D%271200%27%20height%3D%27465%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\" data-srcset=\"http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise-200x78.jpg 200w, http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise-400x155.jpg 400w, http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise-600x233.jpg 600w, http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise-800x310.jpg 800w, http:\/\/www.netboss.nl\/wp-content\/uploads\/2025\/06\/domain-compromise.jpg 1200w\" data-sizes=\"auto\" data-orig-sizes=\"(max-width: 718px) 100vw, 1200px\" \/><\/span><\/div><div class=\"fusion-text fusion-text-2\"><p><span style=\"font-weight: 400;\">shows the full path to full control of the domain.<\/span><\/p>\n<h2><b>The solution: realistic testing<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">NodeZero:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">discovers third-party vulnerabilities<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">combines them with credential misuse<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">shows realistic attack paths<\/span><\/li>\n<\/ul>\n<h2><b>What you&#8217;re missing without NodeZero<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Invisible risks through trusted software<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Compliance risks from vulnerabilities out of your sight<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Slowness in detection and response<\/span><\/li>\n<\/ul>\n<h2><b>What you gain with NodeZero<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Understanding your entire attack surface<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Awareness of third-party risks.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Evidence rather than assumptions<\/span><\/li>\n<\/ul>\n<\/div><div class=\"fusion-text fusion-text-3\"><h2 style=\"text-align: center;\">Review:<\/h2>\n<h3 style=\"text-align: center;\"><span style=\"font-weight: 400;\">\u201cOur Veeam was secure according to the vendor. NodeZero thought otherwise.\u201d<\/span><\/h3>\n<\/div><div class=\"fusion-text fusion-text-4\"><p><span style=\"font-weight: 400;\">Want to know if your IT landscape is truly secure? Order your pen test directly at <a href=\"https:\/\/www.netboss.nl\/en\/discover-the-hack\/\">https:\/\/www.netboss.nl\/en\/discover-the-hack\/<\/a> <\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":4700,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39],"tags":[],"class_list":["post-4716","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs-en"],"_links":{"self":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/4716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/comments?post=4716"}],"version-history":[{"count":7,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/4716\/revisions"}],"predecessor-version":[{"id":4791,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/posts\/4716\/revisions\/4791"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/media\/4700"}],"wp:attachment":[{"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/media?parent=4716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/categories?post=4716"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.netboss.nl\/en\/wp-json\/wp\/v2\/tags?post=4716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}