2026-07-25 –, Track 2
Abstract
Backup solutions deal with incredibly sensitive data, and for ransomware to be truly effective, backups are a primary target. One of the common backup technologies we encounter during red team engagements is Veeam and it often stores highly privileged credentials needed to perform backup jobs across the environment. Domain Admin, vSphere administrator, ESXi root: all sitting in a database, encrypted with DPAPI, waiting for someone to ask nicely.
In this talk, we walk through how we went from manually extracting credentials from Veeam Backup & Replication and Veeam ONE databases to building and releasing VeeamDumper, a .NET tool and Beacon Object File (BOF) that automates the entire process. We'll cover the credential storage mechanisms and encryption differences between VBR and Veeam ONE (including the undocumented Veeam ONE entropy value we had to figure out ourselves), the DPAPI decryption chain, and how extracted credentials map to infrastructure targets for lateral movement.
Beyond the tool itself, we'll break down the process of porting a .NET post-exploitation tool into a BOF including the design decisions, the pain points, and why having both gives operators flexibility across different C2 frameworks. We'll demonstrate VeeamDumper live, from enumeration through to cleartext credential extraction and target mapping.
We'll close with the defender's perspective: what makes Veeam infrastructure vulnerable, why domain-joining backup servers to your primary AD domain is asking for trouble, and practical hardening steps to stop us from doing exactly what we just showed you.
VeeamDumper will be released as open-source prior to this talk.
Talk Overview
1. Why Attackers Love Your Backups
The role of backup infrastructure in targeted attacks and ransomware operations. Why Veeam servers are high-value targets and what we keep finding during real-world engagements: domain-joined backup servers, over-privileged service accounts, and credentials that unlock far more than just backup jobs.
2. How Veeam Stores Credentials (And How We Extract Them)
The technical internals: how VBR and Veeam ONE store credentials in MSSQL and PostgreSQL databases, how DPAPI encryption is applied differently between the two products, and the undocumented Veeam ONE entropy value that isn't covered in Veeam's own KB articles. We'll walk through the decryption chain step by step, from encrypted database blob to cleartext password.
3. Building VeeamDumper: From Manual Process to Automated Tooling
How repeated encounters with Veeam during engagements drove us to automate the extraction process. The design of VeeamDumper's modules (ENUM, AUTO, MSSQL/PSQL, MAP), why we built it as a .NET assembly for execute-assembly compatibility, and how the MAP module connects extracted credentials to specific infrastructure targets.
4. From .NET to BOF: Porting Post-Exploitation Tooling to C
The process of taking a working .NET tool and porting it into a Beacon Object File. Why BOFs exist, what changes when you move from managed .NET to raw C and practical lessons for anyone building red team tooling
5. Live Demo: VeeamDumper in Action
Live demonstration of VeeamDumper against a lab environment: enumeration, automatic credential extraction, DPAPI decryption, and credential-to-target mapping. We'll show both the .NET execute-assembly path and the BOF execution.
6. Securing Your Backup Infrastructure
Practical hardening guidance: why backup servers should not be domain-joined to your primary AD domain, how to restrict access to credential stores, detection opportunities for credential extraction activity, and the questions every organisation should be asking about their backup security posture.
Key Takeaways
Veeam backup servers frequently store Domain Admin-level credentials in a reversible format and once an attacker has local admin on the server, extracting them is straightforward.
Veeam ONE handles credential encryption differently to VBR using an undocumented entropy value, a detail not covered in Veeam's public documentation that we had to reverse ourselves.
VeeamDumper automates the full extraction chain enumeration, database identification, DPAPI decryption, and credential-to-target mapping as both a .NET assembly and a BOF, released as an open-source tool on MWR's GitHub.
Porting .NET post-exploitation tooling to a BOF involves meaningful design tradeoffs of which we'll share the practical lessons for anyone building red team tools that need to operate across C2 frameworks.
Domain-joining backup servers to your primary AD domain creates a compounding risk that turns a single compromise into full infrastructure takeover, including the destruction of your recovery capability.
I am a Principal Consultant and Red Team Lead at MWR CyberSec, specialising in offensive security and adversary simulations.
I am a computer engineer who is a self-motivated and disciplined individual impassioned by cybersecurity and technology. I'm a hard worker and willing to go the extra mile because I am ambitious, eager to succeed and always enthusiastic to learn. I take pride in what I do and see myself as being conscientious and diligent, with a good work ethic. I am proactive, innovative and "think outside the box".
I have a passion for performing red team exercises, namely simulating real-world advanced cyberattacks where I can employ the latest tactics, techniques and procedures to execute on attacker goals whilst remaining undetected; with the aim of identifying security weaknesses and areas where change can be implemented to enhance security practices.