BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
Why this severity: CVSS 9.8 (v3.1, CNA), actively exploited (CISA KEV)
- Started
- Dec 5, 2024
- Closed
- Dec 19, 2024
Affected
- Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)
Fixed in
- Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16
Updates by day6
▸Dec 30, 2024
Link #Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT
Source
▸Dec 19, 2024
Link #CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)
Source
▸Dec 17, 2024
Link #CVE-2024-12356 published
Source
▸Dec 16, 2024
Link #BeyondTrust advisory BT24-10; cloud instances patched
Source
▸Dec 8, 2024
Link #BeyondTrust notifies the US Treasury
Source
▸Dec 5, 2024
Link #BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key
Source
Advisories4
News & write-ups2
Notes & caveats
Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
