Urgent Cyber Alert: NHS England Responds to Critical Vulnerability in Veeam Software

In an alarming development for organizations relying on Veeam’s Backup & Replication software, NHS England’s National Cyber Security Operations Centre (CSOC) has issued a high-severity cyber alert. This alert is a direct response to the active exploitation of a critical vulnerability, identified as CVE-2024-40711. The urgency of this situation cannot be overstated, as ransomware groups are reportedly leveraging this vulnerability to escalate their attacks.

Background on the Vulnerability

The alert follows a security bulletin released by Veeam in September, which detailed one critical and five high-severity vulnerabilities, including CVE-2024-40711. This particular vulnerability is classified as a critical “deserialization of untrusted data” issue, boasting a CVSSv3 score of 9.8. If successfully exploited, it allows unauthenticated attackers to execute remote code on targeted systems, posing a significant risk to enterprise environments.

Shortly after Veeam disclosed the vulnerability, exploitation attempts began to surface, prompting NHS CSOC to issue a warning. The advisory emphasizes the need for rapid patching and other defensive measures, echoing previous alerts such as cyber alert CC-4542, which highlighted similar vulnerabilities.

The Mechanics of Exploitation

Florian Hauser, a security researcher with CODE WHITE, was instrumental in discovering CVE-2024-40711. He has publicly warned about the potential consequences of unpatched enterprise backup and disaster recovery systems. Cyber threat groups are increasingly targeting these systems due to their critical role within corporate networks.

Recent reports from Sophos X-Ops indicate a surge in ransomware attacks linked to CVE-2024-40711. Attackers have been using compromised credentials alongside this vulnerability to deploy ransomware variants such as Akira and Fog. The exploitation typically involves leveraging the /trigger endpoint on port 8000 within Veeam, allowing attackers to spawn local Administrator accounts and gain further access to compromised networks.

In one notable incident, attackers deployed Fog ransomware on an unprotected Hyper-V server, subsequently using the rclone utility to exfiltrate sensitive data. These attacks often begin with unauthorized access to VPN gateways that lack multifactor authentication and may be running outdated software versions.

The Importance of Patching and Security Measures

Javvad Malik, Lead Security Awareness Advocate at KnowBe4, emphasizes the critical need for organizations to address unpatched vulnerabilities and implement multifactor authentication, especially for software with public-facing components. He notes that social engineering remains the primary method for cybercriminals to infiltrate organizations, followed closely by the exploitation of unpatched vulnerabilities.

Malik stresses that organizations can significantly reduce their risk by focusing on these areas. He points out that many incidents stem from the absence of multifactor authentication on VPN gateways, highlighting that security software should not be assumed to be secure by default.

The Ransomware Landscape

Adam Pilton, a Senior Cybersecurity Consultant at CyberSmart, underscores the ongoing trend of cybercriminals exploiting vulnerabilities to deploy ransomware. He notes that since 2019, the financial gains of ransomware gangs have generally increased, with the exception of a dip in 2022 likely due to geopolitical factors. The current landscape suggests that ransomware attacks will continue to rise, making it imperative for organizations to bolster their defenses.

Pilton reiterates that the exploit in question has a security patch available, and applying this patch is crucial for effective vulnerability management. He emphasizes that organizations must prioritize patching known vulnerabilities, upgrading outdated VPNs, and implementing multifactor authentication to mitigate risks.

Proactive Measures for Organizations

In light of the ongoing exploitation of CVE-2024-40711, NHS England’s National CSOC urges organizations to take immediate action. Patching software vulnerabilities, particularly those currently being exploited, is essential for preventing unauthorized access and safeguarding sensitive data.

As ransomware tactics evolve, businesses must adopt a layered approach to cybersecurity, strengthening defenses at every stage of the attack chain. This includes not only patching vulnerabilities but also enhancing user awareness and training to recognize potential threats.

Conclusion

The recent alert from NHS England serves as a stark reminder of the ever-present threat posed by cybercriminals, particularly in the realm of ransomware. Organizations must remain vigilant and proactive in their cybersecurity efforts, ensuring that they are equipped to defend against emerging threats. By prioritizing patch management, implementing robust security measures, and fostering a culture of cybersecurity awareness, businesses can significantly reduce their risk and protect their critical assets in an increasingly hostile digital landscape.