Veeam Backup & Replication (VBR) Infrastructure & Enterprise Recovery Plane Hermes Threat Score rates Veeam infrastructure at 94 (CRITICAL). In enterprise architectures, Veeam servers maintain concentrated privileged credentials (domain admin accounts, hypervisor API keys, cloud storage secrets) and control the definitive recovery baseline. Compromising the backup server enables adversaries to decapitate business continuity and guarantee ransom leverage.
Understanding the functional boundaries between Veeam components is essential for both threat modeling and DFIR triage. Veeam does not operate as a single monolithic process; it delegates operations across distinct administrative roles.
Veeam Backup & Replication (VBR) Component Architecture:
┌─────────────────────────────────────────────────────────────────────────────┐ │ Veeam Backup Server (Control Plane) │ │ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ │ │ │ Veeam Backup Service │ │ Veeam Broker Service │ │ Configuration DB │ │ │ │ (Veeam.Backup.Service│ │ (Port 6170 / 6171) │ │ (PostgreSQL / MSSQL) │ │ │ │ Port 9401) │ └──────────────────────┘ └──────────┬───────────┘ │ │ └──────────┬───────────┘ │ │ │ │ ┌──────────────────────┐ │ │ │ │ │ VeeamThreatHunterSvc │ │ │ │ │ │ (.NET Remoting 6175) │ │ │ │ │ └──────────────────────┘ │ │ └────────────┼─────────────────────────────────────────────────┼──────────────┘ │ │ Control │ (Management RPC / REST) │ Credential Channels │ │ Lookups ▼ ▼ ┌───────────────────────────┐ ┌───────────────────────────┐ │ Backup Proxy │ │ Backup Repository │ │ ┌───────────────────────┐ │ │ ┌───────────────────────┐ │ │ │ Veeam Transport Svc │ │ Data Streams │ │ Veeam Transport Svc │ │ │ │ (Veeam.Backup.MountSvc│ │ (TCP 2500-3300) │ │ (Veeam Data Mover) │ │ │ │ Port 6172) │─┼────────────────────►│ │ (Linux Hardened / XFS │ │ │ └───────────────────────┘ │ │ │ Immutable Store) │ │ │ Guest Interaction Proxy │ │ └───────────────────────┘ │ └─────────────┬─────────────┘ └───────────────────────────┘ │ ▼ ┌───────────────────────────┐ │ Protected Workloads │ │ (VMware ESXi, Hyper-V, │ │ Windows/Linux Agents) │ └───────────────────────────┘The Backup Server coordinates all data protection workflows, scheduling, cataloging, and infrastructure management.
Veeam.Backup.Service.exe: The central management engine running as LocalSystem or a dedicated service account. It orchestrates job execution, coordinates with proxies, and communicates with the configuration database. Listens on TCP port 9401.Veeam.Backup.BrokerService.exe: Facilitates interaction between the backup console UI, PowerShell snap-ins, and the backend engine over TCP port 6170/6171.VeeamThreatHunterSvc.exe: Introduced in modern releases (VBR v12.x) to conduct inline malware entropy scanning, ransomware indicator matching, and YARA validation on backup streams. Listens on TCP port 6175 via .NET Remoting.Veeam.Backup.Configuration.Service.exe: Coordinates configuration backup and disaster-recovery restoration routines.Veeam.Backup.MountService.exe: Mounted on proxies and mount servers to manage vPower NFS mounts, guest OS file-level indexing, and instant VM recovery. Listens on TCP port 6172.reflink block-cloning and immutable file attributes (chattr +i). Uses non-persistent single-use credentials during deployment to prevent administrative takeover from the control plane.The following matrix documents the critical network ports, protocols, and daemon bindings across the Veeam ecosystem. Defenders must enforce strict micro-segmentation around these ports.
| Port / Protocol | Listening Daemon | Component | Security Significance & Exploitation Vectors |
|---|---|---|---|
6170 / TCP | Veeam.Backup.BrokerService.exe | Backup Server | Broker API for management console and REST endpoints. |
6172 / TCP | Veeam.Backup.MountService.exe | Mount Server / Proxy | Mount service handling vPower NFS and file-level recovery. Targeted in CVE-2024-40711 (unauthenticated RCE via binary deserialization). |
6175 / TCP | VeeamThreatHunterSvc.exe | Backup Server | Binary .NET Remoting channel for malware detection. Exploited in CVE-2026-44963 via ObjRef whitelist bypass. |
9392 / TCP | VeeamEnterpriseManagerSvc.exe | Enterprise Manager | REST API and web portal for multi-server management. Historical target for auth bypasses (CVE-2024-29849 via SAML SSO). |
9401 / TCP | Veeam.Backup.Service.exe | Backup Server | Core management TCP channel. Targeted in CVE-2023-27532 for unauthenticated credential harvesting. |
9380 / TCP | VeeamDeploymentService.exe | Backup / Proxy | Distribution and deployment service. Exploited in CVE-2022-26500 / CVE-2022-26501 for unauthenticated RCE. |
2500 - 3300 / TCP | VeeamDataMover.exe / veeamtransport | Repositories & Proxies | Dynamic data transfer channels between source proxies and target repositories. Transmits raw compressed backup streams. |
5432 / TCP | PostgreSQL Instance | Database Host | Default database engine for VBR v12+. Stores encrypted configuration and credential records. |
1433 / TCP | Microsoft SQL Server Instance | Database Host | Legacy database engine for VBR v11 and upgraded instances. |
To automate enterprise-wide operations, Veeam stores privileged credentials for every system it interacts with:
Credential Protection Flow in VBR Configuration Database:
┌─────────────────────────────────────────────────────────────┐ │ Stored Credential (Domain Admin / VMware ESXi Root) │ └──────────────────────────────┬──────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────┐ │ Protected Storage Encryption: │ │ - Microsoft DPAPI (CryptProtectData) │ │ - Scope: CryptProtectData with CRYPTPROTECT_LOCAL_MACHINE │ │ - VBR v12.1+: Registry-Derived Random Salt (Entropy) │ └──────────────────────────────┬──────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────┐ │ Configuration Database Table: [dbo].[Credentials] │ │ - XML Blob containing: │ │ <Credentials user="..." password="<Encrypted_Base64>" /> │ └─────────────────────────────────────────────────────────────┘Because the Veeam Backup Service runs as a service account without interactive user presence, credentials must be decryptable by the system itself during background jobs. Consequently, Veeam relies on DPAPI with CRYPTPROTECT_LOCAL_MACHINE scope.
This architectural constraint has severe security implications:
LocalSystem or local Administrator on the VBR server can decrypt every credential in the database.Veeam-Get-Creds or SharpVeeamDecryptor.In contemporary ransomware operations, the encryption phase is merely the final step of a multi-week intrusion. The backup infrastructure sits directly on the critical path of the adversary’s playbook.
Adversary Ransomware Execution Sequence:
[Phase 1: Initial Access] └── SSL-VPN / Perimeter Appliance (Cisco, SonicWall, Fortinet) │ ▼ [Phase 2: Discovery & Reconnaissance] └── Port scan for Veeam endpoints: TCP 9401, 6172, 6175, 9392 └── Query Active Directory for SPNs: "Veeam*", "VBR*" │ ▼ [Phase 3: Backup Subversion & Credential Harvesting] ├── Exploit Veeam CVE (CVE-2023-27532 / CVE-2024-40711 / CVE-2026-44963) ├── Decrypt credentials table -> Obtain vCenter & Domain Admin accounts └── Disable backup schedules & terminate Veeam services │ ▼ [Phase 4: Backup Destruction & Sabotage] ├── Purge backup chains: Remove-VBRBackup / Delete from disk ├── Disable immutability / Tamper with retention policies └── Drop VSS snapshots: vssadmin delete shadows /all /quiet │ ▼ [Phase 5: Datastore & Host Encryption] └── Deploy ransomware payload (Akira, Qilin, Fog) across ESXi & WindowsAdversaries deliberately neutralize backups because:
.vbk) using offline tools to extract and exfiltrate sensitive files, intellectual property, and PII directly from historical disk images without alerting live file servers.Multiple elite threat actor groups actively maintain weaponized tooling specifically engineered to compromise Veeam environments.
The Akira syndicate (tracked by DFIR investigators since March 2023) has demonstrated an intense operational focus on Veeam Backup & Replication infrastructure.
Initial Foothold & Discovery
Akira operators typically gain initial entry by exploiting vulnerabilities or credential reuse on perimeter VPN gateways (Cisco ASA/FTD, SonicWall SSL-VPN) lacking multi-factor authentication. Once inside the internal network, they run automated scanners (NetScan, AdFind) specifically probing for hosts with open TCP port 9401 or TCP port 6172.
Veeam Exploitation & Credential Extraction
In 2023 and 2024, Akira weaponized CVE-2023-27532 to query the unauthenticated backup API and extract encrypted credentials from the database. Following the public disclosure of CVE-2024-40711, Akira integrated pre-auth RCE exploits targeting Veeam.Backup.MountService.exe (TCP 6172) to spawn reverse shells as NT AUTHORITY\SYSTEM.
Decapitating Hypervisor Recovery
After compromising the VBR server, Akira dumps the vCenter Server root credentials from the Veeam database. They log into the vCenter web interface or SSH into individual ESXi hypervisors, terminate the Veeam backup agent services, and execute their Linux ELF encryptor directly across VMFS datastores.
Backup Sabotage
Akira scripts execute PowerShell commands using the Veeam snap-in (Remove-VBRBackup -Backup $b -FromDisk -Confirm:$false) or issue low-level disk formatting commands against attached storage repositories, ensuring that even historical increments are permanently obliterated.
Financially motivated threat group FIN7 was among the earliest confirmed threat actors to weaponize Veeam vulnerabilities in wide-scale automated campaigns:
POWERTRASH, DICELOADER) that communicated directly with Veeam.Backup.Service.exe over raw TCP sockets on port 9401, extracted the encrypted credentials, and beaconed them back to FIN7 command-and-control (C2) servers.In late 2024 and early 2025, security researchers (notably Sophos X-Ops and Huntress) identified distinct ransomware campaigns orchestrated by Qilin and Fog weaponizing CVE-2024-40711:
Veeam.Backup.MountService.exe (port 6172).point or point2 (net user point <password> /add && net localgroup administrators point /add).%TEMP%.The lessons learned from real-world Veeam compromises dictate that defense cannot rely solely on perimeter protection. Security teams must operationalize four foundational investigative and architectural controls:
chattr +i) and single-use deployment credentials. Even if the Windows VBR server is compromised with SYSTEM privileges, an attacker cannot delete or alter immutable XFS extents over the network.Veeam.Backup.Service.exe, Veeam.Backup.MountService.exe, VeeamThreatHunterSvc.exe) spawns cmd.exe, powershell.exe, net.exe, or certutil.exe.