Tech · 18 d ago
Carl Lender from Sunrise, USA · CC BY 2.0 · Wikimedia Commons
China-linked hackers used a hidden flaw to take over IT support servers
A flaw attackers use before a fix exists
zero-day
A group called Armory Castle exploited an unknown flaw in BeyondTrust Remote Support appliances, tools IT teams use to reach computers from afar, BeyondTrust and Mandiant said. Both describe it as a Chinese state-sponsored espionage operation.
How it unfolded
-
Aug 29
First exploitation of the flaw on one self-hosted appliance
-
Sep 27
A similar attack on another vendor prompts BeyondTrust to investigate
-
Oct 9
Fix pushed to all cloud customers
-
Oct 16
US cyber agency CISA urges users to patch
Once inside, the attackers took control of the appliance, read every password it stored and moved into other systems on the victim's network.
Why it matters
Mandiant said any vulnerable appliance reachable from the internet should be treated as potentially compromised until reviewed. The group has a record of exploiting flaws widely once they become public.
What users should do
Organizations running the software should apply the BT26-05-RS patch, limit outside access to the appliance, and check it for signs of intrusion, the US Cybersecurity and Infrastructure Security Agency said.
