Google links BeyondTrust Remote Support zero-day to suspected China-nexus group

A suspected China-nexus espionage group that Google tracks as ARMORY CASTLE exploited in BeyondTrust Remote Support as a zero-day in late August. The flaw lets an unauthenticated attacker perform file operations on the appliance, which can lead to control of the host and every credential it stores. Google says widespread exploitation may follow now that the flaw is public.

Editor: Austin Simas
Updated: Oct 19, 6:00 a.m. ET
Corrections: None
CVE
Vendor: BeyondTrust

What to do

5 steps

1Apply the patch for versions through ; older versions must upgrade first.
2Apply the precautionary patch to self-hosted Privileged Remote Access, which shares the affected code.
3Treat any appliance that was internet-reachable on a vulnerable version as possibly compromised.
4Preserve evidence on those appliances before rebuilding them from a clean, fully patched image, as Google advises.
5Rotate credentials only after patching or rebuilding, as Google advises.

Affected and fixed versions

Product	Affected	Fixed
Remote Support, self-hosted	through	Patch
Remote Support, self-hosted	Older than	Upgrade, then apply
Remote Support, SaaS	All instances	Patched by BeyondTrust as of Oct 9

Product
Remote Support, self-hosted
Affected
through
Fixed
Patch
Product
Remote Support, self-hosted
Affected
Older than
Fixed
Upgrade, then apply
Product
Remote Support, SaaS
Affected
All instances
Fixed
Patched by BeyondTrust as of Oct 9

Timeline

Oct 15BeyondTrust publishes advisory , and Google publishes its report on ARMORY CASTLE.
Oct 16CISA adds to its KEV catalog, with a due date of Oct 19.

Sources

Google Threat IntelligencePrimary source cloud.google.com
BeyondTrust advisoryPrimary source beyondtrust.com
BeyondTrust blogPrimary source beyondtrust.com

Corrections

No corrections to this story.

Spotted an error? Tell us and we’ll correct it.