ALPHV Ransomware Affiliate Exploits Weak Backup Systems to Launch Attacks

The Veritas Backup software vulnerabilities were exploited by an ALPHV/BlackCat ransomware affiliate to gain entry into the targeted network.

Mandiant has identified a new ALPHV affiliate, known as UNC4466, exploiting vulnerabilities in Veritas Backup Exec installations exposed to the internet.

Over 8,500 instances of Veritas Backup Exec were found to be publicly exposed and potentially vulnerable to the three vulnerabilities. Unlike previous ALPHV intrusions that relied on stolen credentials, this affiliate appears to be targeting known vulnerabilities opportunistically.

ALPHV has gained notoriety for targeting critical infrastructure and health entities, in contrast to some other ransomware operators who have avoided such targets. This attack is detailed in a blog post by Mandiant, which includes information on detection and indicators.

Mandiant observed the ALPHV ransomware affiliate, UNC4466, exploiting high-severity vulnerabilities impacting the Veritas Backup software, namely CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878, for initial access to victim environments.

According to Mandiant, a commercial scanning service has revealed the existence of over 8,500 IP addresses publicly advertising the “Symantec/Veritas Backup Exec ndmp” service on ports 10000, 9000, and 10001.

Mandiant’s findings reveal that the UNC4466 threat actor group compromised a Windows server running Veritas Backup Exec using a Metasploit module and maintained access to the host.

They used tools like Advanced IP Scanner and ADRecon to gather information about the victim’s environment and downloaded additional tools, including the ALPHV ransomware encryptor. The group used SOCKS5 tunneling for C2 communication and employed BITS transfers to download tools and deploy the ransomware payload.

To escalate privileges, the group used Mimikatz, LaZagne, and Nanodump to steal user credentials and evade detection by clearing event logs and disabling Microsoft Defender’s real-time monitoring.

Defenders can use the guidance provided in Mandiant’s report to detect UNC4466 attacks promptly and take necessary measures to prevent the execution of the ALPHV payload on their systems.