Google Warns of Potential Mass Exploitation of BeyondTrust Remote Support Flaw by China-Linked Hackers

Google warned organizations Thursday to prepare for potential widespread exploitation of a newly disclosed vulnerability in BeyondTrust remote support appliances. A suspected China-linked hacking group identified as Armory Castle previously exploited the flaw in August when it was still unknown. Successful exploitation grants attackers access to credentials, allows arbitrary file uploads, and enables complete control over the host system, according to Google Threat Intelligence Group and Mandiant. BeyondTrust Remote Support is an enterprise tool used by information technology teams to remotely access and troubleshoot computers and other internal devices. Google stated that public disclosure of the flaw will likely trigger broader exploitation attempts by Armory Castle and other threat actors, urging swift action to patch or mitigate the vulnerability.