top of page
Search

Two Ransomware Crews, One Backup Bug. SafePay and Qilin Both Go Through Veeam, and That Bug Has Been in KEV Since 2023.

Writer: Patrick Duggan
Patrick Duggan
26 minutes ago
7 min read

If you run Veeam Backup & Replication, check today that CVE-2023-27532 and CVE-2024-40711 are patched and that the backup server cannot be reached from the internet or from your VPN user range. In the same week, two separate reports named that backup server as part of ransomware intrusions. On October 20, CISA, the FBI and the Secret Service, with German and UK police, published an advisory on SafePay ransomware that lists both Veeam bugs among the ways in. On October 19 and 20, Palo Alto's Unit 42 updated its brief on Qilin and INC ransomware crews getting in through a GlobalProtect VPN bug and then chaining a Veeam exploit, CVE-2023-27532. That Veeam bug has been in CISA's Known Exploited Vulnerabilities catalog since August 22, 2023.





Who found it


The research here is not ours. The SafePay findings come from the joint advisory AA26-293A, #StopRansomware: SafePay Ransomware, written by the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit. The Qilin and INC findings come from Unit 42's threat brief on CVE-2026-0257. Our part is reading both, putting them side by side, adding their indicators to our feed with the junk taken out, and checking our own edge.



SafePay: about 600 victims, many of the ways in are years old


The advisory says SafePay has been active since August 2024 and has hit at least 600 victims across several critical infrastructure sectors in North America, South America, Europe and Australia. Investigations behind it ran as recently as August 2026.


SafePay gets in by stealing or guessing passwords, phishing, and exploiting edge devices. The advisory describes two groups of bugs:


  • VPN access with phished accounts, through Mullvad VPN addresses: Cisco ASA and Firepower Threat Defense bugs CVE-2023-20269 (in KEV since September 13, 2023) and CVE-2020-3259 (in KEV since February 15, 2024).

  • Internet-exposed systems, hit with automated scripts: Veeam CVE-2023-27532 (KEV since August 22, 2023), Veeam CVE-2024-40711 (KEV since October 17, 2024) and SonicWall CVE-2024-40766 (KEV since September 9, 2024).

The newest of those five has been in KEV for two years. Once inside, SafePay uses ordinary admin tools: PsExec, WinRM, RDP, remote management software, ShareFinder and SharpShares to find file shares, then RClone, WinSCP, FileZilla or OneDrive to take the data out. Before encrypting, it stops the Volume Shadow Copy service and resets the network storage that holds the backups to factory settings. Then it encrypts with ChaCha20 and RSA, adds the .SafePay extension, posts on a leak site, and phones the victim. The advisory's indicator file labels one of the locker.dll samples as LockBit 3.0-derived.



Qilin and INC: the VPN, then the hypervisor, then the backup server


Unit 42's October 19 update says ransomware crews it tracks as Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that lets an attacker set up a VPN session without valid credentials, getting around MFA. Unit 42 says its investigations have been running since early June 2026 across more than ten industries, including healthcare, education, government and utilities. It also notes public reporting that ties a third ransomware family, Settra, to the same bug.


What happens next is the part that matters. In one case Unit 42 describes, the attackers went from the VPN gateway to the vCenter management appliance, switched off an ESXi setting (execInstalledOnly) that stops unsigned code from running on the hypervisor, and used a custom tool to dump domain credentials straight from a domain controller's virtual disk. Doing it from the hypervisor means the endpoint security agent running inside Windows never sees it. Unit 42 also says it has seen these crews chain the VPN access with exploit tools for Veeam backup servers, naming CVE-2023-27532.


We covered the first half of this story before. On June 15 we wrote about four edge appliances being exploited in one weekend, PAN-OS among them, and on July 21, when Arctic Wolf tied the GlobalProtect bug to Qilin, we wrote Qilin is now riding a Palo Alto VPN auth bypass. What is new this week is the second half: the hypervisor and the backup server.



A date we checked: [CVE-2026-0257](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-0257) entered KEV on May 29, not May 13


Unit 42's brief says CVE-2026-0257 was added to KEV on May 13, 2026. CISA's own catalog says May 29, with a remediation due date of June 1. We checked CISA's public catalog history as well: the KEV files CISA published on May 13, May 15 and May 28 do not contain CVE-2026-0257, and the May 29 file does. Palo Alto shipped the fix on May 13, which is probably where the earlier date came from. Unit 42 also gives May 29 as the date the public proof-of-concept appeared, so the KEV listing and the public exploit code landed on the same day. Our KEV mirror has May 29.



The backup server is the soft spot


Put the two reports side by side and the pattern is plain. One crew uses the backup server as a way in from the internet. The other reaches it after the VPN, on the way to the hypervisor. Either way, the system that is supposed to get you back on your feet is the one they go after, and the Veeam bug both reports name has had a fix and a federal deadline since 2023.


A backup server is attractive for three reasons. It holds credentials for most of the machines it backs up. It can read, and often delete, the copies you would restore from. And it tends to be patched less often than the servers it protects, because nobody wants to touch the thing that saves you.



What to do now


  1. Patch the five SafePay bugs and the GlobalProtect bug, oldest first. Cisco ASA and FTD: CVE-2023-20269 (KEV September 13, 2023) and CVE-2020-3259 (KEV February 15, 2024). Veeam Backup & Replication: CVE-2023-27532 (KEV August 22, 2023) and CVE-2024-40711 (KEV October 17, 2024). SonicWall SonicOS: CVE-2024-40766 (KEV September 9, 2024). PAN-OS GlobalProtect: CVE-2026-0257 (KEV May 29, 2026). CISA marks all six as known to be used in ransomware campaigns.

  2. Wall off the backup server. Veeam's management service should not answer from the internet or from the VPN address pool. Give it its own admin accounts, not domain accounts, and keep at least one copy of your backups where the backup server's own credentials cannot delete it: immutable or offline.

  3. Lock down the hypervisor. Keep vCenter off user networks, alert on anyone turning off execInstalledOnly on an ESXi host, and treat a domain controller's virtual disk as being as sensitive as the domain controller itself.

  4. Hunt in your VPN logs. Unit 42 asks GlobalProtect customers to search for successful logins from the nine addresses below, and for device names and host IDs from the public exploit code: aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT.

  5. Watch for the SafePay tool kit. PsExec, WinRM, ShareFinder, SharpShares, RClone, WinSCP and Backblaze's b2.exe showing up on servers that never use them, and anything stopping Volume Shadow Copy.


Indicators, and the six we left out on purpose


The advisory's indicator file holds 19 indicators. We added 13 of them to our feed under the source research-import-cisa-aa26-293a, each credited to the advisory, and we left six out.


In our feed:


Left out: four IP addresses and two hashes. 104.26.2.223 is a Cloudflare address. 140.82.114.4 is GitHub. 185.199.108.133 is GitHub Pages. 173.194.194.94 is Google, listed in the advisory as hosting victim data. The two hashes are NetExec and SharpShares, public tools that penetration testers and IT staff use every day.


That is the problem with importing an advisory wholesale. Every one of those six was really seen in a SafePay intrusion, and the advisory itself asks readers to check addresses before blocking them. But a blocklist that carries a GitHub or Cloudflare address breaks things for everyone who uses it, and a hash alert on a common admin tool trains people to ignore alerts. If the feed you use took all 19, look at what it took.


From Unit 42's brief we also added the nine GlobalProtect addresses it lists, under the source research-import-unit42-cve-2026-0257: 23.128.228.6, 104.207.144.154, 146.19.216.119, 146.19.216.120, 146.19.216.125, 179.43.172.213, 185.195.232.139, 198.12.106.60 and 202.144.192.47. Unit 42 lists them as addresses to look for from before the public exploit appeared on May 29. It does not tie them to Qilin or INC, and neither do we. They are five months old, so we scored them 60 to 65, and 185.195.232.139 at 40 because it is a Mullvad VPN exit that ordinary people share. Use them to search old VPN logs, not to block.


All 22 records were read back from our index by their record IDs today. The scores are our view of the evidence. The floor is yours: ips.csv takes a min_confidence setting, and setting it to 80 keeps only the three SafePay servers scored 80 or higher.



What our own edge saw


Nothing, and that is not a finding about the attackers. We searched our edge blocks, our edge decoys and our origin decoy for GlobalProtect and SSL-VPN login paths and for the request paths in nine public exploits for CVE-2026-0257, from September 22 to October 22. That covered 28,555 edge blocks, 29,604 decoy hits and 1,663 origin captures, with zero matches. We don't run a GlobalProtect decoy, and Veeam's management service is not a web page, so our edge could not have seen the Veeam half at all. Nothing here came from our sensors, and we are not claiming we saw it first.



Get the indicators


The 22 indicators above are in our free feed. A free key takes about 30 seconds.


We checked this post before publishing: about 50 checkable claims, 4 corrected or cut. The KEV date for CVE-2026-0257 as Unit 42 gave it; a diagram arrow that made the backup storage reset look like Qilin and INC's work, when CISA says it of SafePay; a diagram arrow that put Veeam after SafePay's foothold, when the advisory lists it as a way in; and a line about news coverage repeating the wrong date, which we had not checked ourselves. At least 5% of what remains is still wrong, and we don't know which.


If this was useful, or if it wasn't, rate it at the bottom of the page. It is the only direct signal we get.




Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.



Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=safepay-qilin-inc-two-crews-one-veeam-backup-bug



Comments

Rated 0 out of 5 stars.
No ratings yet
Add a rating
bottom of page