Dive Brief:

• Weeks after BeyondTrust disclosed an attack spree against a limited number customers, more than 8,600 instances of the company’s Privileged Remote Access and Remote Support products remain exposed, according to a blog post released Thursday by Censys. 
• BeyondTrust in December warned that an attacker gained access to a limited number of Remote Support SaaS instances utilizing a compromised API key. This week, the U.S. Department of Treasury said a suspected state-linked attacker gained access to a number of workstations and stole unclassified information using a BeyondTrust key.
• Censys researchers, in the Thursday blog, indicated that not all of the exposed instances are considered vulnerable, because the firm does not have access to the versions involved.

Dive Insight:

The attacks highlight the potential risks involved in government agencies and other key sectors depending on remote support tools to conduct business. BeyondTrust last year said it had more than 20,000 customers in its portfolio and is used by 75 of the Fortune 100.  

BeyondTrust last month disclosed and patched a critical vulnerability, listed as CVE-2024-12356, as well as a medium severity vulnerability, listed as CVE-2024-12686 during an investigation of the attack spree.

CVE-2024-12356, a critical command injection vulnerability, has a CVSS score of 9.8 and was added to the Cybersecurity and Infrastructure Security Agencies known exploited vulnerabilities catalog in December.

BeyondTrust has not explicitly linked the vulnerabilities to the attack spree, but is working with authorities and outside experts to investigate the cause and better understand the impact. 

The Treasury Department said the attackers used a stolen key to override security systems and gain access to the workstations. There was no specific reference to what role the CVEs played in the attacks against the workstations. 

Sen. Tim Scott and Rep. French Hill, vice chair of the House Financial Services Committee, sent a letter to Treasury Secretary Janet Yellen demanding a briefing on the incident by Jan. 10. The Treasury Department originally disclosed the attack in a letter to Scott and Sen. Sherrod Brown.