Veeam Service Provider Console (VSPC) Users Urged to Patch CVE-2024-42448 and CVE-2024-42449

Category	Details
Threat Actors	Potential exploitation by threat actors leveraging RCE and privilege escalation vulnerabilities.
Campaign Overview	Veeam released patches addressing critical RCE and file manipulation vulnerabilities in Service Provider Console.
Target Regions (Or Victims)	Organizations utilizing Veeam Service Provider Console for backup and disaster recovery operations.
Methodology	Exploits RCE for unauthorized control and uses NTLM hash extraction for privilege escalation.
Product Targeted	Veeam Service Provider Console (VSPC), versions 8.1.0.21377 and earlier.
Malware Reference	Not directly referenced; highlights potential for malware deployment or ransomware.
Tools Used	Exploitation of vulnerabilities CVE-2024-42448 and CVE-2024-42449.
Vulnerabilities Exploited	CVE-2024-42448 (RCE, CVSS 9.9), CVE-2024-42449 (NTLM hash extraction, CVSS 7.1).
TTPs	Exploits RCE for system compromise, NTLM hash theft for lateral movement, and file deletion for operational disruption.
Attribution	No direct attribution to specific threat groups; prior Veeam vulnerabilities were exploited by Akira, Fog, and Frag ransomware groups.
Recommendations	Upgrade to VSPC version 8.1.0.21999, apply patches immediately, and discontinue unsupported versions.
Source	SocRadar

Read full article: https://socradar.io/veeam-service-provider-console-vspc-cve-2024-42448/
Disclaimer: The above summary has been generated by an AI language model