ClosedPatched
Day · Dec 19, 2024
BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)
Updates on Dec 19, 2024
CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)
Source
Summary
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
Read the full incident →
