What happened
BeyondTrust issued a warning to its customers regarding a critical security vulnerability affecting its Remote Support (RS) product. The flaw, classified as a zero-day, has been actively exploited in attacks since late August. Exploitation is confirmed in the wild, indicating that malicious actors are using the vulnerability to compromise affected systems. At the time of disclosure, no vendor patch was available to remediate the flaw. The exploitation of this vulnerability poses a high severity risk, given its active usage and potential for critical impact on affected deployments.
Who is affected
Any organisations running BeyondTrust Remote Support are potentially vulnerable to this zero-day flaw. Since the exploit is actively observed in wild campaigns, affected deployments across various sectors may be targeted. The nature of the vulnerability and its active exploitation underscore the need for awareness among all users of the impacted product to monitor their environments for signs of compromise.
Recommended actions
- Monitor for indicators of compromise related to the exploitation of the BeyondTrust Remote Support vulnerability.
- Implement network controls to restrict access to BeyondTrust Remote Support where possible, particularly preventing unauthorised external connections.
- Review and strengthen existing security measures surrounding remote support and management services to prevent unauthorised access or lateral movement post-compromise.
