BeyondTrust has urged customers to patch a critical authentication bypass in Remote Support that attackers have exploited since late August. The flaw affects version 26.2.3 and earlier and lets an unauthenticated remote attacker perform file operations on vulnerable appliances. SaaS customers were patched on 8 October, but self-hosted installations need manual updates. Mandiant attributes the attacks to a suspected China-nexus espionage group that gained root access and moved laterally through victims' networks.

What it means: Remote support and privileged access tools are among the most attractive targets because they hold credentials and open sessions into many other systems. An attacker who controls such an appliance effectively has the keys to the network. The BeyondTrust case fits a familiar pattern: the same group has previously exploited flaws in Citrix and Ivanti products, always on devices at the network edge. The key detail is that exploitation began about six weeks before a fix was available. Patching alone is therefore not enough, and Mandiant advises treating any exposed vulnerable appliance as potentially compromised until reviewed. For Greek banks, IT service providers and large firms using the product, the practical sequence is to patch, hunt for signs of compromise, rotate every credential the appliance managed and review sessions opened to other systems. For entities under DORA or NIS2, an incident like this may trigger reporting duties. More generally, access management systems should not be reachable directly from the internet.

Read the original on BleepingComputer

Related service: Custom software

Related stories