CISA says Treasury was the only US agency breached via BeyondTrust
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12356 | Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an unauthenticated command injection flaw (CWE-77) that allows a remote attacker to inject commands that are executed as a site user. The vulnerability is network-facing with low attack complexity and requires no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), so any attacker who can reach the affected PRA/RS interface can trigger it. Successful exploitation yields arbitrary command execution in the context of the site user, with high impact ratings for confidentiality, integrity, and availability. Any organization running BeyondTrust PRA or RS — particularly where those remote-access/remote-support services are exposed to the internet — is affected; the available data does not specify affected version ranges. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-19, carries an 88% EPSS probability of exploitation within 30 days (100th percentile), and was reportedly used in the breach of the U.S. Treasury alongside a PostgreSQL vulnerability. Do: Apply BeyondTrust's patches or vendor-specified mitigations immediately — remediation is mandatory for U.S. federal agencies under the KEV listing, and the source data does not include fixed build numbers, so confirm the correct upgrade version in BeyondTrust's security bulletin. As an interim measure, restrict or remove internet exposure of PRA/RS endpoints and hunt for signs of exploitation (unexpected commands executed as the site user), noting this flaw was used in the U.S. Treasury intrusion. If mitigations are unavailable, CISA's required action is to discontinue use of the product. | 9.8 | 88% | KEV PoC |
| moderate≈ a few thousand internet-exposed PRA/RS instances (order-of-magnitude estimate from public internet scans) |
Full article424 words · extracted from helpnetsecurity.com · click to collapse
The US Cybersecurity and Infrastructure Security Agency (CISA) has shared on Monday that the Treasury Department was the only US federal agency affected by the recent cybersecurity incident involving compromised BeyondTrust Remote Support SaaS instances.
On the same day, BeyondTrust offered an update on the situation: The forensic investigation into the incident is approaching completion, the company said, and noted that no additional affected customers have been identified since the initial cluster of affected instances was discovered and those customers notified.
What the investigation revealed
In early December 2024, BeyondTrust identified anomalous behavior on “a limited number” of customer instances of Remote Support SaaS and discovered the compromise of an API key for a compromised instance that “allowed for password resets of local application accounts.”
The key was revoked, the instances suspended and quarantined, the impacted customers informed.
The investigation into the incident subsequently revealed two separate vulnerabilites affecting BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) products, one of which has been exploited in the attack.
On December 30, the New York Times reported on a letter sent by the Treasury Department to US lawmakers, confirming that the attack resulted in the compromise of workstations of several government employees and some unclassified documents, and attributing the attack to “a China state-sponsored Advanced Persistent Threat (APT) actor.”
More specifically, the attackers managed to compromise workstations in the department’s Office of Financial Research and the Office of Foreign Assets Control, which administers and enforces economic and trade sanctions.
The Chinese foreign ministry has disputed the claim.
Last week, the Treasury Department sanctioned Beijing-based cybersecurity firm Integrity Technology Group for aiding computer intrusion incidents against US victims mounted by the Flax Typhoon APT group.
“CISA continues to monitor the situation and coordinate with relevant federal authorities to ensure a comprehensive response,” the agency said on Monday. “We are working aggressively to safeguard against any further impacts and will provide updates, as appropriate.”
Censys currently “sees” 13,548 exposed BeyondTrust Remote Support and Privileged Remote Access instances online, though it’s impossible to tell whether they are vulnerable to exploitation via the actively exploited command injection vulnerability (CVE-2024-12356).
“All SaaS instances of BeyondTrust Remote Support have been fully patched against the vulnerabilities mentioned in our previous security advisories. A patch has also been pushed for self-hosted instances,” BeyondTrust said. But organizations whose instances are not subscribed to automatic updates are required to implement the patch themselves.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/01/07/cisa-says-treasury-was-the-only-us-agency-breached-via-compromised-beyondtrust-instances/