VHDVomit

A tool to search SMB shares for VHD/VMDK/VHDX backup files, mount them and dump sensitive data including NTDS.dit, SYSTEM, and SAM hives.

vbkVomit

Extract hashes from Veeam .vbk backup. Reads the VBK directly, finds the NTFS volume inside, walks the MFT, reassembles ntds.dit + SAM/SECURITY/SYSTEM, and runs impacket secretsdump.

VeeamThief

Rogue vSphere server for capturing Veeam Backup & Replication credentials.

Blog: https://adversaryco.com/blog/breaking-bad-backups