BeyondTrust patches Remote Support zero-day exploited since late August

The vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances. No authentication is needed, so exposure to the internet is enough to put an appliance in reach. BeyondTrust shared limited details about the flaw itself.

The vendor said the zero-day was abused in the wild by a suspected espionage actor tracked under several names by Mandiant and Google Threat Intelligence Group and by CrowdStrike. The activity is described as suspected, not confirmed, so treat the naming as provisional.

After gaining access, the intruders deployed new Sawfly web shell and Bareclaw tunneler malware. They wiped logs to evade detection. They then moved laterally through the victim's network using compromised Administrator credentials, opening remote sessions on downstream systems.

If you run BeyondTrust Remote Support, work through the following in order.

1. 01

   Confirm your appliance build

   Open the /appliance interface and check the running version under Status, then compare it against the fixed release listed in the vendor advisory. Anything at or below RS 26.2.3 needs the update now. Record the version for every appliance, including spares and lab instances.

2. 02

   Find every instance you expose

   Query your external asset inventory and your edge firewall rules for anything publishing the appliance on 443. Cross-check with an external scan from outside your network so shadow deployments show up. Any instance reachable from the internet that is not in your inventory is the first thing to fix.

3. 03

   Hunt for web shells on the appliance

   Pull the vendor indicators from the advisory and ask support for a file integrity check, since these appliances limit shell access. Look for recently created or modified files in web-served directories and for scripts that do not match the shipped build. Unexplained files with recent timestamps are the signal to escalate.

4. 04

   Look for tunneling and odd outbound traffic

   Review firewall and NetFlow records for outbound connections from the appliance to destinations it has no reason to reach, especially long-lived sessions on non-standard ports. The appliance should talk to a small, predictable set of endpoints. Sustained egress to unfamiliar addresses deserves a full investigation.

5. 05

   Check for log gaps

   Compare appliance logs held locally against the copies in your central log platform and look for missing intervals or sudden drops in event volume since late August. If logs are not forwarded off the device, fix that first with syslog export. A gap with no maintenance window behind it is a finding, not noise.

6. 06

   Rotate and review administrative credentials

   Reset local appliance accounts, any service accounts used for integrations, and Administrator credentials used for downstream sessions. Then search authentication logs on those downstream systems for remote sessions opened outside normal hours or from unexpected sources. Repeated logons from a jump path you do not recognise should be treated as lateral movement.