Item 1 in the brief for Mon, Oct 19

BeyondTrust Remote Support zero-day used to take over appliances, Google says

A flaw in BeyondTrust Remote Support, , lets an unauthenticated attacker perform file operations on the appliance, and an attacker exploited it before a fix existed. Google tracks the attacker as ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage group, and says it planted a web shell, gained root and tried to dump stored credentials. BeyondTrust dates the first attack to Aug 29, against one of its hosted instances, and knows of two affected customers. It released patch BT26-05-RS on Oct 8, patched SaaS instances by Oct 9 and disclosed the flaw on Oct 15.

Affected: Remote Support 26.2.3 and earlier, self-hosted and SaaS; BeyondTrust patched SaaS instances by Oct 9. All versions and fixes
CVE
Vendor: BeyondTrust
Published: Oct 19, 6:00 a.m. ET
Editor: Austin Simas

What to do

6 steps

1Apply patch BT26-05-RS to self-hosted Remote Support 24.3.1 through 26.2.3, upgrading older versions first, and the precautionary BT26-05 patch to self-hosted Privileged Remote Access.
2Preserve appliances exposed while vulnerable before any change, Google advises: snapshot virtual ones with memory and export the disk, or have BeyondTrust Support preserve hardware and SaaS ones.
3Collect syslog, reverse proxy and firewall logs for the whole time each appliance was exposed. BeyondTrust and Google say the attacker deletes logs on the appliance.
4Rebuild every appliance not shown to be clean from a fully patched image, since Google says the attacker’s root access survives reboots and configuration resets.
5Rotate the credentials the appliance stores or brokers, starting with its administrator accounts, once it’s patched or rebuilt. Google says rotating earlier exposes the new ones.
6Compare the /login configuration with a baseline from before the attacks began in late August, removing unrecorded changes such as Jump Item roles raised to Administrator, as Google advises.

Affected and fixed versions

Product	Affected	Fixed
Remote Support, self-hosted	`24.3.1` through `26.2.3`	Patch `BT26-05-RS`
Remote Support, self-hosted, older versions	Before `24.3.1`	Upgrade, then apply patch `BT26-05-RS`
Remote Support SaaS	`26.2.3` and earlier	Patched by BeyondTrust as of Oct 9

Product
Remote Support, self-hosted
Affected
24.3.1 through 26.2.3
Fixed
Patch BT26-05-RS
Product
Remote Support, self-hosted, older versions
Affected
Before 24.3.1
Fixed
Upgrade, then apply patch BT26-05-RS
Product
Remote Support SaaS
Affected
26.2.3 and earlier
Fixed
Patched by BeyondTrust as of Oct 9

Indicators

Type	Value	Note
SHA-256		SAWFLY web shell, per Google
File name		SAWFLY web shell’s file name in this intrusion
SHA-256		BARECLAW tunneler, per Google
File name		BARECLAW tunneler’s file name, run from /tmp
File name		Copy of the system shell the attacker set to run as root
File name		Startup script that gives the site account passwordless root

SHA-256SAWFLY web shell, per Google
File nameSAWFLY web shell’s file name in this intrusion
SHA-256BARECLAW tunneler, per Google
File nameBARECLAW tunneler’s file name, run from /tmp
File nameCopy of the system shell the attacker set to run as root
File nameStartup script that gives the site account passwordless root

Timeline

Aug 29The attacker first exploits the flaw against one BeyondTrust-hosted Remote Support instance, BeyondTrust says.
Sep 28BeyondTrust’s threat hunting finds signs of the attack on the hosted instance.
Sep 30Mandiant shares findings from a self-hosted customer that confirm what BeyondTrust found.
Oct 8BeyondTrust releases the patch for SaaS and self-hosted customers.
Oct 15BeyondTrust and Google disclose the flaw and the attacks.
Oct 16CISA adds the flaw to KEV with an Oct 19 due date.

Sources

BeyondTrust security advisoryPrimary source beyondtrust.com
BeyondTrust blogPrimary source beyondtrust.com
Google Threat IntelligencePrimary source cloud.google.com
CISA KEV catalogPrimary source cisa.gov