ClosedPatched
Day · Dec 16, 2024
BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
Updates on Dec 16, 2024
BeyondTrust advisory BT24-10; cloud instances patched
Source
Summary
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
Read the full incident →
