#veeam — Public Fediverse posts

Der Podcast zum letzten Pandolin-Beitrag ist jetzt auch online:
https://castopod.pandolin.online/@pandolin
https://podcasts.apple.com/de/podcast/pandolin-on-air/id1886739185

https://www.pandolin.io/vendor-konsolidierung-telekom-csp-broadcom-veeam/

🎙️ Folge 03: Wenn der Magenta-Riese kippt
Microsoft hat der Telekom den CSP-Distributor-Status entzogen. Broadcom drückt Margen, Veeam reduziert das VCSP-Programm.
Drei Fälle, ein Muster. 31 Min zur Frage, was T2-Partner stattdessen tun sollten.
#MicrosoftCSP #Veeam #Broadcom #VendorLockIn #FOSS #PandolinOnAir

**Wenn der Magenta-Riese kippt: drei Fälle, ein Muster.**
Microsoft hat der Deutschen Telekom gerade den CSP-Indirect-Distributor-Status entzogen. Stichtag 20. Mai. Brack/Alltron in der Schweiz: schon raus. KOMSA in Deutschland: auch raus. Telekom: jetzt auch.
Parallel, gleiches Muster bei anderen Vendoren:
🔻 **Broadcom/VMware**: alle Partnerverträge 2024 gekündigt, nur ausgewählte zurückgelassen. Margen historisch halbiert. Wer Pinnacle-Status behalten wollte, hat ihn mit erheblichen Zugeständnissen erkauft.
🔻 **Veeam**: reduziert das VCSP-Programm gerade massiv. Aggregatoren und Service-Provider verlieren ihre Rental-Lizenzen – inklusive global agierender Lizenzhäuser und etablierter DACH-Player.
Drei verschiedene Auslöser (Distributor-Schwelle / PE-Übernahme / IPO-Vorbereitung), dieselbe Mechanik: Der Vendor sitzt am längeren Hebel. „Partnerschaft" ist kein Status, sondern ein Privileg, das jederzeit entzogen oder neu verhandelt werden kann.
Die populäre Antwort darauf – „lasst uns Partner als Block bündeln, dann haben wir mehr Verhandlungsmasse" – kollektiviert das Abhängigkeitsproblem, statt es zu lösen. Größer-werden gegen einen Hersteller, der schneller größer wird, ist keine Strategie. Symptom-Behandlung. Kein Architektur-Fix.
Was wirklich trägt: Vendor-agnostisches Tooling, Distributoren mit echter Vendor-Neutralität, Migrations-Runbooks bevor die Mail kommt, und FOSS-Alternativen ernsthaft pilotieren – Proxmox, Nextcloud, Nakivo sind 2026 belastbar genug.
Wer keine Alternative kennt, kann nicht verhandeln.

Volle Analyse mit anonymisiertem Telekom-Brief:
https://www.pandolin.io/vendor-konsolidierung-telekom-csp-broadcom-veeam/

#MicrosoftCSP #Veeam #Broadcom #VendorLockIn #ChannelStrategy #FOSS #Proxmox #linux

Den heutigen Tag ernenne ich zum Tag des Backups. Gefühlt habe ich mich nur um Backups in verschiedenen Szenarien gekümmert.

1. Windows Server Backup mit #VSS
2. #Veeam für Hyper-V
3. Skript für #restic angepasst
4. Mit #Powershell für einen Updatedienst herumgespielt

#Restore mache ich dann morgen. 😉

#backup

Sooo, #backrest is not really my thing either. You can't change the connection settings of an existing repository, which means no credential rotation and no clean way to handle IP changes when a server moves. That's a pretty fundamental limitation for a backup solution.

I'll take a closer look at #restic without relying on a frontend.

I'm also skeptical about #Borg #Backup and, more broadly, backup tools built on Python/Ruby/shell stacks. There's a lot of room for subtle breakage without strict type safety, and pushing performance-critical parts down into C/C++/ASM layers doesn't exactly inspire confidence either.

Makes me wonder what enterprise solutions look like under the hood. Apparently #Veeam is C#, which is actually a reasonable choice - but requiring a Windows server (and not being OSS) makes it a non-starter for me.

Sooo, #backrest is not really my thing either. You can't change the connection settings of an existing repository, which means no credential rotation and no clean way to handle IP changes when a server moves. That's a pretty fundamental limitation for a backup solution.

I'll take a closer look at #restic without relying on a frontend.

I'm also skeptical about #Borg #Backup and, more broadly, backup tools built on Python/Ruby/shell stacks. There's a lot of room for subtle breakage without strict type safety, and pushing performance-critical parts down into C/C++/ASM layers doesn't exactly inspire confidence either.

Makes me wonder what enterprise solutions look like under the hood. Apparently #Veeam is C#, which is actually a reasonable choice - but requiring a Windows server (and not being OSS) makes it a non-starter for me.

Sooo, #backrest is not really my thing either. You can't change the connection settings of an existing repository, which means no credential rotation and no clean way to handle IP changes when a server moves. That's a pretty fundamental limitation for a backup solution.

I'll take a closer look at #restic without relying on a frontend.

I'm also skeptical about #Borg #Backup and, more broadly, backup tools built on Python/Ruby/shell stacks. There's a lot of room for subtle breakage without strict type safety, and pushing performance-critical parts down into C/C++/ASM layers doesn't exactly inspire confidence either.

Makes me wonder what enterprise solutions look like under the hood. Apparently #Veeam is C#, which is actually a reasonable choice - but requiring a Windows server (and not being OSS) makes it a non-starter for me.

Sooo, #backrest is not really my thing either. You can't change the connection settings of an existing repository, which means no credential rotation and no clean way to handle IP changes when a server moves. That's a pretty fundamental limitation for a backup solution.

I'll take a closer look at #restic without relying on a frontend.

I'm also skeptical about #Borg #Backup and, more broadly, backup tools built on Python/Ruby/shell stacks. There's a lot of room for subtle breakage without strict type safety, and pushing performance-critical parts down into C/C++/ASM layers doesn't exactly inspire confidence either.

Makes me wonder what enterprise solutions look like under the hood. Apparently #Veeam is C#, which is actually a reasonable choice - but requiring a Windows server (and not being OSS) makes it a non-starter for me.

OVHcloud lance Backup Agent, une solution basée sur Veeam pour la sauvegarde des serveurs dédiés https://www.it-connect.fr/ovhcloud-lance-backup-agent-une-solution-basee-sur-veeam-pour-la-sauvegarde-des-serveurs-dedies/ #Entreprise #Sauvegarde #OVHcloud #Cloud #Veeam

🚨 Incident Response
===================

Executive summary: A real-world red team engagement demonstrated how a compromised Veeam Backup & Replication server can be an escalation pivot to full Domain Admin. The engagement began with an Active Directory misconfiguration and ended with domain-wide privileges after extracting backup-related credentials.

Technical details:
• Compromised host: Veeam Backup & Replication server.
• Exposed artifacts: service account credentials, access to backup repositories, backup job configurations and encrypted domain-level credentials contained in backup metadata or configuration stores.
• Initial vector: AD misconfiguration that allowed access to the Veeam host.

Analysis:
• Backup servers frequently store high-privilege secrets by design (service accounts, domain credential blobs, and recovery credentials). Compromise of those hosts provides both lateral movement and privilege escalation opportunities.
• The engagement shows the combination of credential exposure in backups and repository access is sufficient to reconstruct domain-level access paths.

Detection:
• Monitor changes and remote access to backup servers and to accounts used by backup services.
• Audit access to backup repositories and any processes that read encrypted credential blobs or configuration exports.
• Track anomalous enumeration of backup job configurations and unusually timed repository reads.

Mitigation (as described in the engagement):
• Treat backup infrastructure as a high-value asset: limit administrative access, isolate backup network paths, and apply least-privilege to service accounts.
• Protect backup repositories and rotate service credentials; ensure credential material in backups is guarded by strong encryption and access controls.

References / keywords: Veeam Backup & Replication, Active Directory misconfiguration, service account exposure, backup repository access, encrypted domain credentials.

🔹 backup_security #veeam #incident_response

🔗 Source: https://whiteknightlabs.com/2025/12/09/from-veeam-to-domain-admin-real-world-red-team-compromise-path/

Kann mir jemand ein gutes Backup-Tool für #Windows empfehlen?
Aktuell nutze ich den #Veeam Agent und sichere auf ein Netzwerklaufwerk auf einer #Hetzner #Storagebox.
#Veeam möchte allerdings regelmäßig ein Komplett-Backup anlegen, was häufig fehlschlägt, weil der Rechner nur ein paar Stunden eingeschaltet ist.

Ich suche etwas Moderneres – idealerweise ein Tool wie #Borg oder #Restic, aber mit einer GUI für Windows.

On ITSPmagazine hashtag#Webinars:
🚨 94% of hashtag#ransomware victims had their hashtag#backups attacked.
Let that sink in for a moment.

Organizations spend thousands on backup solutions. They follow best practices. They sleep better thinking their data is safe. But here's the uncomfortable truth: if your storage can be compromised, it will be.

In our latest ITSPmagazine webinar, I sat down with Sean Martin, CISSP and Anthony Cusimano from Object First to expose a critical gap in most backup strategies.

The statistics are not looking good:
→ 93% of hashtag#cyberattacks specifically target hashtag#backupstorage
→ Most "immutable" solutions aren't really immutable at all
→ Organizations don't even realize their backups are sitting ducks

As Anthony revealed: "People don't even know what they don't know."
The ransomware playbook is devastatingly simple: take out the backups, hold companies hostage, get paid. And here's the kicker - many attackers have no idea how to actually restore the data even after receiving the ransom.

This conversation isn't just about technology. It's about protecting livelihoods, businesses, and the people who depend on them.

Ready for the complete deep dive on ransomware-proof backups and absolute immutability?

🎯 Watch the teaser and then go for the full webinar: https://www.crowdcast.io/c/an-itspmagazine-webinar-with-object-first-august-2025

What's your organization's backup reality check story?
When was the last time you tested your recovery process?

Or you can go (and subscribe) on our ITSPmagazine YouTube Channel to watch our exclusive teaser that breaks down why your backup strategy might be failing: https://www.youtube.com/watch?v=kqbd-Tg3aHI

#ransomwareprotection #databackup #businesscontinuity #objectfirst #veeam

Ransomware Attacks Target 94% of Company Backups | Why Your Cybersecurity May Be Failing

94% of ransomware victims had their backups attacked. 93% of cyber attacks specifically target backup storage. Yet most people aren't even concerned about this.
In this eye-opening teaser from our ITSPmagazine webinar, cybersecurity expert Anthony Cusimano from Object First reveals why most "immutable" backup solutions aren't really immutable at all - and why that could destroy your business.

Ransomware Attacks Target 94% of Company Backups | Why Your Cybersecurity May Be Failing

#ransomwareprotection #cybersecurity #ransomwareattacks #cybersecurityawareness #dataprotection #backupstorage #absoluteimmutability #ObjectFirst #cyberthreats #datarecovery #veeam

https://youtu.be/kqbd-Tg3aHI

https://youtu.be/kqbd-Tg3aHI

Unlocking the Power of S3 Compatible Storage: A Comprehensive Guide

#StoneFly #Veeam #ransomwareprotection #dataprotection #s3storage #immutable #S3Storage 🌐 #s3appliance #objectstorageappliance #s3storageappliance #localobjectstorage #locals3storage #s3compatiblestorage #objectstoragesolutions #cloudstorage #privatecloud #virtualization #vmware #DataStorage #OnPremiseS3 #TechRevolution 🚀

https://stonefly09.mystrikingly.com/blog/unlocking-the-power-of-s3-compatible-storage-a-comprehensive-guide-83940a3a-0ce1-44e1-9a9b-4ae6a8e8013a

Thinking about ditching free #Veeam backup for backup of my #windows workstation in favor of #UrBackup. I just need daily incremental and weekly full dump of main disk and some files. Anybody has any experience with it?

https://www.urbackup.org/

@finn This is a very good question. 😀 #esxi #vsphere #veeam

Another week, another newsletter - catch up on the week's infosec news here:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.

#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.

#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign

#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.

Have a great week ahead folks, I hope this newsletter proves helpful!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD

Another week, another newsletter - catch up on the week's infosec news here:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.

#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.

#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign

#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.

Have a great week ahead folks, I hope this newsletter proves helpful!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD

Another week, another newsletter - catch up on the week's infosec news here:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.

#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.

#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign

#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.

Have a great week ahead folks, I hope this newsletter proves helpful!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD

Another week, another newsletter - catch up on the week's infosec news here:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.

#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.

#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign

#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.

Have a great week ahead folks, I hope this newsletter proves helpful!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD

Another week, another newsletter - catch up on the week's infosec news here:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.

#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.

#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign

#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?

The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.

Have a great week ahead folks, I hope this newsletter proves helpful!

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423

#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD

Catch up on everything cyber with this week's edition of our SOC Goulash newsletter!:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-373

Images which were redacted or cropped on Google Pixel devices or using the Windows Snipping Tool can be reversed and sensitive data revealed. The bug, dubbed "Acropalypse", may have been fixed but any existing images - be they bank details, nudes, or confidential company information - remain up for grabs.

#Hacktivists launched a week-long, coordinated attack on Australian banks, hospitals, airports and more, in retaliation for an offensive submission by an Australian designer at the Melbourne Fashion Festival, of all things.

The takedown of #BreachForums was made official last week, with the subsequent disarray demonstrating that continued law enforcement action is succeeding in capitalising on the mistrust inherent to the cyber crime ecosystem.

A significant vulnerability in the #WooCommerce Payments plugin can let attackers takeover #WordPress sites, and a PoC #exploit has been released publicly for a vulnerability in #Veeam's backup software.

The #blueteam had a great week, with CISA releasing a tool that helps grab #Azure, #M365 and the #Defender suite telemetry to help run ad hoc investigations; #Splunk shared an awesome defensive guide to #ADCS attacks, and we've seen a bunch of great write-ups on #IcedID, #ASyncRAT, and more!

Catch all this and much more in this week's newsletter:

https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-373

#infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #soc #threatintel #threatintelligence #acropalypse #OpAustralia #darkweb #CISA

Do you make backups for your personal stuff? Like photo’s, video’s, your git projects, etc. If yes do you follow the 3-2-1 rule?

https://www.veeam.com/blog/321-backup-rule.html?amp=1

Poll is anonymous, I cannot see who voted what

#Veeam #VeeamVanguard #Backup #SecureYourData

New Blog Post - Veeam Orchestrator and NetApp : aggregate not found - https://tsmith.co/2022/veeam-orchestrator-netapp-aggregate-not-found/

#Veeam #BCDR #NetApp