The BeyondTrust Breakout: Why Pre-Auth RCE Remains 2025’s Ransomware “Holy Grail”

In the high-stakes game of enterprise security, there is no prize more coveted by a threat actor than a Pre-Authentication Remote Code Execution (RCE) on a critical security appliance. It is the digital equivalent of finding the master key to a bank lying on the sidewalk.

Throughout late 2024 and into 2025, that key was found—repeatedly. The discovery and exploitation of critical vulnerabilities in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) sent shockwaves through the industry. With CVSS scores reaching 9.8 and 9.9, these vulnerabilities represent the “Holy Grail” for sophisticated threat actors: they require no credentials, no user interaction, and provide immediate, high-privilege access to the very tools designed to protect the “Paths to Privilege.”

This article provides a comprehensive analysis of the BeyondTrust security incidents, exploring why remote access tools remain the ultimate target and how a single unpatched instance can lead to full domain compromise in minutes.

The Anatomy of Critical Command Injection: CVE-2024-12356 and Beyond

At their core, the BeyondTrust vulnerabilities discovered in late 2024 are Unauthenticated OS Command Injection flaws. These reside in specific backend components of the BeyondTrust appliance, handling incoming WebSocket connections—the same communication pathway that makes remote support possible.

The Technical “Ouch”

CVE-2024-12356 (CVSS 9.8) was the first shoe to drop in December 2024. This critical vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands within the context of the site user by sending specially crafted requests through malicious client connections.

The flaw is triggered during the WebSocket handshake process. When a client (or an attacker) attempts to connect to specific endpoints of a BeyondTrust appliance, insufficient input validation allows specially crafted parameters to break out of intended logic and execute arbitrary system commands.

However, research from Rapid7 later revealed that successful exploitation of CVE-2024-12356 actually required chaining it with another critical vulnerability: CVE-2025-1094, a SQL injection flaw in an underlying PostgreSQL tool. This chain gave attackers the complete access they needed.

The injection payload structure allows attackers to escape arithmetic evaluation contexts and execute commands through shell subprocesses. For an unauthenticated attacker, this is the equivalent of having a direct terminal into the appliance’s heart before they’ve even typed a username.

CVE-2024-12686 (Medium Severity) was disclosed shortly after, affecting BeyondTrust PRA and RS versions 24.3.1 and earlier. This command injection vulnerability can be exploited by a user with existing administrative privileges to upload malicious files and execute underlying operating system commands.

Why This is the “Holy Grail” for Advanced Threat Actors

To understand why these specific vulnerabilities are so devastating, we have to look at the “Identity-Centric” nature of modern threat landscapes. We are no longer in the era of simple “viruses”; we are in the era of Identity Exploitation.

1. The Gateway to Everything

BeyondTrust appliances are not “edge devices” in the traditional sense—they are Identity Hubs. They hold the keys to the kingdom:

Stored Credentials: Local and domain accounts used for support
Active Sessions: Real-time access to servers and workstations across the globe
Network Trust: These appliances usually sit in privileged network segments with the ability to “see” almost everything else in the data center
Credential Vaults: SSH keys, session tokens, and passwords for the most sensitive systems

BeyondTrust provides identity security services to more than 20,000 customers across over 100 countries, including 75% of the Fortune 100. This ubiquity has attracted state-sponsored actors repeatedly.

2. Pre-Auth: The Wall That Wasn’t

Most RCEs require a foothold—a stolen password, a phished session token, or a bored employee clicking a link. Pre-auth means the “Wall” is gone. An attacker sitting in a coffee shop in Frankfurt can hit an instance in New York and be inside the network before the morning coffee is brewed.

3. High Privilege by Design

The site user context in which these commands execute is highly privileged. While not technically “root,” it has enough leverage to:

Dump the PostgreSQL database (containing configuration and potentially sensitive metadata)
Manipulate managed sessions
Intercept network traffic passing through the appliance
Create and authorize new administrative sessions

Timeline of a Crisis: The U.S. Treasury Breach

The speed at which this moved from “discovery” to “mass exploitation” is a testament to the modern, AI-accelerated threat cycle. The most notable incident was the breach of the U.S. Treasury Department.

Date	Event
September 2024	Silk Typhoon (APT27) gains initial access to BeyondTrust infrastructure
December 2, 2024	Suspicious activity detected on BeyondTrust platform
December 5, 2024	BeyondTrust confirms platform breach and takes protective measures
December 8, 2024	BeyondTrust notifies Treasury Department and other affected customers; Remote service shut down
December 16, 2024	BeyondTrust identifies and discloses CVE-2024-12356, releases patch
December 18, 2024	CVE-2024-12686 disclosed in advisory BT24-11
December 19, 2024	CISA adds CVE-2024-12356 to Known Exploited Vulnerabilities (KEV) catalog
December 30, 2024	Treasury Department notifies Congress via formal letter
January 2025	CISA adds CVE-2024-12686 to KEV catalog
January 2025	Rapid7 reveals CVE-2025-1094 (PostgreSQL SQL injection) used in exploit chain
March 5, 2025	U.S. Department of Justice indicts two Silk Typhoon members: Yin Kecheng and Zhou Shuai

The Silk Typhoon Connection: A Recurring Nightmare

One of the most concerning aspects of the BeyondTrust vulnerabilities is their exploitation by Silk Typhoon (also known as APT27, Hafnium, Bronze Union, Emissary Panda). This Chinese state-sponsored group has been linked to the December 2024 breach of the U.S. Treasury Department.

Attack Profile

In the Treasury breach, threat actors:

Stole a BeyondTrust Remote Support SaaS API key in September 2024
Exploited CVE-2024-12356 chained with CVE-2025-1094 to gain unauthenticated remote code execution
Accessed approximately 419 Treasury computers across multiple offices
Exfiltrated over 3,000 unclassified files from workstations
Targeted the Office of Foreign Assets Control (OFAC) - focusing on sanctions and trade enforcement data
Compromised high-level accounts including files related to Secretary Janet Yellen and Deputy Secretary Wally Adeyemo

The breach went undetected for approximately three months (September to December 2024), highlighting Silk Typhoon’s sophisticated tradecraft in maintaining stealth within compromised environments.

Silk Typhoon’s Evolving Tactics

According to Microsoft Threat Intelligence research published in March 2025, Silk Typhoon has significantly evolved its tactics:

Supply Chain Focus: Shifting from direct organizational targets to Managed Service Providers (MSPs) and IT supply chain companies
Cloud Expertise: Demonstrating sophisticated understanding of both on-premises and cloud environments
API Key Theft: Abusing stolen API keys and compromised credentials as primary entry vectors
OAuth Application Abuse: Compromising multi-tenant applications with administrative permissions
Data Exfiltration via Microsoft Graph: Harvesting email, OneDrive, and SharePoint data through legitimate APIs
Password Reconnaissance: Discovering corporate passwords leaked on public repositories like GitHub

Microsoft describes Silk Typhoon as holding “one of the largest targeting footprints among Chinese threat actors,” capable of quickly weaponizing zero-day vulnerabilities.

Historical Context

This isn’t Silk Typhoon’s first rodeo with remote access tools:

2021: Exploited four zero-day vulnerabilities in Microsoft Exchange Server
2023: Compromised Citrix NetScaler ADC and Gateway (CVE-2023-3519)
2024: Exploited Palo Alto Networks firewalls (CVE-2024-3400)
January 2025: Exploited Ivanti Pulse Connect VPN zero-day (CVE-2025-0282)

This pattern suggests a “localized, recurring challenge” with input validation within remote access execution pathways. For attackers, these tools are the gift that keeps on giving.

From Appliance Breach to Domain Admin: The Kill Chain

How does an attacker go from a single WebSocket request to encrypting your entire environment? It’s faster than you think.

Step 1: Reconnaissance (The Scan)

Attackers use automated scanners to identify vulnerable internet-facing BeyondTrust instances. At the time of disclosure:

Censys observed 8,602 exposed BeyondTrust RS & PRA instances globally (January 2, 2025)
72% of exposed instances were geolocated in the United States
By January 6, 2025, this number increased to 13,548 instances—approximately 5,000 more in just 4 days

Step 2: The Handshake (The Exploit)

The attacker sends the crafted WebSocket request to vulnerable endpoints. Within seconds, they have command execution capability on the appliance. In documented cases, attackers deployed:

China Chopper or AntSword web shells
Custom Python scripts for database manipulation
Tools for temporary administrative account hijacking

Step 3: Credential Harvesting & Session Hijacking

Research has observed attackers:

Querying the PostgreSQL database to extract stored credentials, session tokens, and SSH keys
Hijacking the primary Administrative Account (User ID 1) by injecting new password hashes
Gaining full GUI access for 60-120 seconds—just long enough to authorize a new “Support” session

Step 4: Lateral Movement

Using the appliance’s native “Jump” capabilities, attackers move to high-value targets:

Domain Controllers for full Active Directory access
Backup servers to ensure data loss
Critical infrastructure systems with privileged access

Documented persistence tools include:

SimpleHelp RMM (Remote Monitoring and Management) tool
VShell backdoors
SparkRAT for multi-platform persistence

Step 5: Persistence & Privilege Escalation

Arctic Wolf’s February 2025 analysis of active exploitation campaigns revealed attackers:

Deploying SimpleHelp binaries renamed to appear legitimate (e.g., “remote access.exe”)
Writing binaries to ProgramData root directory with SYSTEM-level execution
Using PSExec to install SimpleHelp across multiple devices in the environment
Creating new domain accounts and adding them to high-privilege groups:
- Domain Administrators
- Enterprise Administrators
Using AdsiSearcher to enumerate Active Directory computer inventory
Leveraging Impacket SMBv2 for remote access and lateral movement

Step 6: Data Exfiltration & Final Objectives

Sensitive data is:

Compressed and exfiltrated via DNS tunneling or Out-of-Band Application Security Testing (OAST) channels
Stolen through legitimate APIs (Microsoft Graph, Exchange Web Services)
Harvested from email, OneDrive, and SharePoint using compromised OAuth applications

Final payloads may include:

Ransomware deployment for financial gain
Long-term espionage for nation-state objectives
Supply chain compromise for downstream customer access

Are You At Risk? Affected Versions & Remediation

If you are running self-hosted BeyondTrust products, the window for “wait and see” closed months ago.

Affected Products & Versions

Product	CVE	Affected Versions	Fixed Version
Remote Support (RS)	CVE-2024-12356	All versions	24.3.1+
Privileged Remote Access (PRA)	CVE-2024-12356	All versions	24.3.1+
Remote Support (RS)	CVE-2024-12686	24.3.1 and earlier	22.1+ (requires patch)
Privileged Remote Access (PRA)	CVE-2024-12686	24.3.1 and earlier	22.1+ (requires patch)

Critical Note: If you are running legacy versions (RS < 21.3 or PRA < 22.1), you cannot apply the patch directly. You must upgrade to a supported version first. These legacy instances are the primary targets for current threat operations.

Cloud Customers: BeyondTrust automatically patched all SaaS instances, requiring no further action.

Immediate Mitigation Steps

1. Patch Immediately

This is the only permanent fix. Follow vendor guidance at BeyondTrust Trust Center.

2. Restrict Network Access

Move the appliance’s web portal behind a VPN or use strict IP allowlisting
Do not leave WebSocket endpoints exposed to the general internet
Segment network access to trusted administrative networks only

3. Audit Logs Aggressively

Look for indicators of compromise:

HTTP Access Patterns: - HTTP GET requests to /get_portal_info followed by immediate WebSocket upgrades to /nw - Unusual remoteVersion parameters in WebSocket handshakes - Anomalous connections from unexpected geographic locations

Post-Exploitation Indicators: - SimpleHelp RMM binaries in ProgramData directory - File description: “SimpleHelp Remote Access Client” - Suspicious filenames: “remote access.exe”, “support.exe” - PSExec activity distributing executables across multiple devices - Impacket SMBv2 session setup requests early in compromise timeline - AdsiSearcher queries for Active Directory enumeration - New domain accounts created and added to admin groups - Unusual net user and nltest commands for domain reconnaissance

4. Monitor Outbound Traffic

Look for unusual DNS queries or connections to known OAST domains (e.g., interactsh, burpcollaborator)
Monitor for data exfiltration via legitimate APIs (Microsoft Graph, EWS)
Check for suspicious OAuth application consents with administrative permissions

5. Credential Rotation

Rotate all stored credentials in the BeyondTrust credential vault
Change administrative passwords for accounts with access to the appliance
Review and revoke suspicious OAuth application permissions
Audit service principal permissions in Azure AD/Entra ID

6. Hunt for Persistence

Search for renamed legitimate tools (SimpleHelp, AnyDesk, TeamViewer) used maliciously
Check for webshells (China Chopper, AntSword) in web-accessible directories
Review scheduled tasks and startup items for persistence mechanisms

The Reconnaissance Reality: GreyNoise Intelligence

GreyNoise sensors provide valuable intelligence on the exploitation landscape:

Early Exploitation Timeline

February 10, 2025: Proof-of-concept exploits for newer variants published on GitHub
February 11, 2025: GreyNoise records reconnaissance probing for vulnerable instances
Within 24 hours: Mass scanning campaigns observed globally

Attack Characteristics

Single dominant actor: One IP address accounted for 86% of all observed reconnaissance sessions
- Associated with a commercial VPN service in Frankfurt, Germany
- Active scanner since 2023, rapidly adopted new vulnerability checks
Non-standard ports targeted: Attackers systematically probed clusters of non-standard ports, suggesting knowledge that enterprises often move BeyondTrust to non-default ports for “security through obscurity”
Linux-based scanning: 100% of sessions showed Linux stack characteristics
- TCP fingerprint MSS of 1358 (vs. standard 1460)
- Confirms VPN tunnel encapsulation at network layer

Scanning Sophistication

Attackers demonstrated knowledge of: - BeyondTrust default and non-default deployment patterns - Out-of-Band Application Security Testing (OAST) techniques for vulnerability confirmation - Simultaneous multi-vulnerability exploitation across multiple products

CISA Response & Federal Mandates

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has taken aggressive action:

Known Exploited Vulnerabilities (KEV) Catalog

CVE-2024-12356: Added December 19, 2024 - Federal agencies required to patch by specific deadline (typically 3 weeks)

CVE-2024-12686: Added January 13, 2025 - Federal agencies required to patch by February 3, 2025

CISA Directive

CISA strongly urges all organizations—not just federal agencies—to:

Apply mitigations per vendor instructions immediately
Discontinue use of the product if mitigations are unavailable
Prioritize timely remediation to reduce exposure to cyberattacks

The Paradox of the Protected Perimeter

The BeyondTrust incidents highlight a fundamental paradox in modern cybersecurity: the tools we use to secure our perimeter are often the most dangerous holes in it.

The Problem with Centralized Privileged Access

Traditional appliances, even high-end ones like BeyondTrust, create a “center of gravity” for attackers. If that center is compromised, the entire security architecture collapses.

Why Remote Access Tools Are Prime Targets: - They are purpose-built gateways to privileged access - They store credentials for the most sensitive systems - They sit in privileged network segments - They have legitimate business reasons to access everything - They are often internet-facing for remote support scenarios

The Rise of “Identity Debt”

These vulnerabilities also expose the “Identity Debt” many organizations carry:

Too many unmanaged, highly privileged service accounts tied to these appliances
Excessive permissions granted to support accounts “just in case”
Stale credentials that should have been rotated long ago
Insufficient monitoring of privileged access usage

When the appliance falls, those accounts become the attacker’s most powerful weapons.

The New Standard of Defense: Moving Beyond Single Points of Failure

CVE-2024-12356, CVE-2024-12686, and the related vulnerabilities aren’t just bugs; they’re warnings. They prove that even in 2025, with all our AI-driven defenses, a simple lack of input sanitization in a critical script can bypass everything.

The Path Forward: Zero Trust Architecture

The industry must accelerate the shift from “Remote Access” to “Identity-Based Access” with Zero Trust principles:

Eliminate Standing Privileges
- Implement Just-In-Time (JIT) access for administrative tasks
- Use ephemeral credentials that expire after single-use
- Grant least-privilege access based on context and risk
Decentralize Identity Management
- Distribute privileged access across multiple, isolated systems
- Implement micro-segmentation to limit blast radius
- Use identity federation with strong MFA everywhere
Assume Breach Mentality
- Continuously monitor for anomalous privileged access
- Implement behavioral analytics for identity threat detection
- Deploy deception technology around crown jewel systems
Secure the Supply Chain
- Vet third-party remote access solutions rigorously
- Implement supply chain risk management programs
- Require security attestations from vendors
- Consider self-hosted alternatives with enhanced monitoring

Lessons for Security Teams

For CISOs and Security Leaders: - Remote access tools should be treated as Tier-0 assets requiring maximum protection - Implement defense-in-depth around privileged access management - Conduct tabletop exercises for identity-based breaches - Invest in threat intelligence for early warning of exploits

For SOC Teams: - Integrate real-time vulnerability intelligence feeds - Monitor for early reconnaissance attempts (even failed ones) - Create custom detection rules for WebSocket anomalies - Hunt for renamed legitimate tools used maliciously

For Identity and Access Management Teams: - Audit all privileged accounts quarterly - Implement credential rotation policies automatically - Monitor for OAuth abuse and suspicious API usage - Use Privileged Access Workstations (PAWs) for admin tasks

Conclusion: The Never-Ending Battle

The BeyondTrust security incidents of 2024-2025 serve as a stark reminder that privileged access management solutions themselves can become the ultimate attack vector. The irony is bitter but instructive: the very tools designed to secure our most sensitive access can, when compromised, provide attackers with everything they need.

Key Takeaways:

Pre-authentication RCE vulnerabilities in identity and access tools represent catastrophic risk
Nation-state actors like Silk Typhoon actively target these high-value systems
Supply chain attacks through compromised MSPs and IT service providers are increasing
Detection requires vigilance: breaches can persist for months undetected
Zero Trust is not optional: single points of failure must be eliminated

The “Holy Grail” of RCE exists because we still rely on single points of failure for our most sensitive access. Moving forward, the industry must embrace:

Decentralized identity architectures
Ephemeral, just-in-time permissions
Continuous verification and monitoring
Segmentation and isolation of privileged systems

No single appliance—no matter how trusted, how expensive, or how “secure” it claims to be—should hold the keys to your entire domain. The BeyondTrust Breakout has taught us that lesson once again.

The question is: will we finally learn?

Resources & References

This article was last updated February 2025 with the latest threat intelligence and exploitation details.