chat
expand_more

Hackers Breach BeyondTrust Remote Support SaaS Instances

Threat actors use API key to gain unauthorized access, but BeyondTrust detected the anomaly early.

Piotr Avatar Synthesia Thumbnail 1x1 1

What is the attack?

  • Initial reports of a breach at BeyondTrust surfaced when it was discovered that hackers had compromised some remote support SaaS instances by obtaining an API key.

  • The attackers leveraged this API key to reset passwords for local application accounts, gaining unauthorized access to BeyondTrust's systems. The breach also revealed vulnerabilities in BeyondTrust's products, including:

    • CVE-2024-12356: A critical command injection vulnerability in Remote Support (RS) and Privileged Remote Access (PRA) products, allowing attackers to execute operating system commands.

    • CVE-2024-12686: A medium-severity vulnerability that enabled administrative privilege misuse for command injection and file uploads.

  • BeyondTrust detected the anomaly early, revoked the compromised API key, and implemented countermeasures to secure affected systems.

Why did it get through?

  • Zero-Day Vulnerabilities: Two vulnerabilities in BeyondTrust’s products allowed successful command injection exploitation opportunities.

  • Exploitation of an API Key: Attackers obtained a valid Remote Support SaaS API key, enabling them to reset passwords and gain unauthorized access to accounts.

What is required to solve for this attack?

  • Proactive Security Testing, Vulnerability Management, and System Hardening: Conduct regular penetration testing and red teaming exercises to identify vulnerabilities, and implement system hardening measures.

  • Behavioral and Anomaly Detection: Deploy tools to monitor for unusual system activity, including abnormal API usage, privilege escalation attempts, and deviations from baseline behaviors to detect and respond to potential attacks in real time.

  • Defense-in-Depth Strategies: Implement multi-layered defenses, including network segmentation, multi-factor authentication for sensitive operations, and robust data encryption with secure key management to minimize the impact of a breach.

Press Links

  • Cybersecurity Dive
  • SecurityWeek
  • CISA