Veeam Credential Extraction via psql.exe Querying VeeamBackup Database

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects unauthorized attempts to access or interact with the Veeam Backup database, including psql.exe direct queries, PowerShell scripts attempting to decrypt credentials using DPAPI, and encoded PowerShell commands launched from cmd.exe that target the Veeam environment.