Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover

Estimated Reading Time: 5 minutes

  • Critical RCE: A CVSS 9.9 vulnerability in BeyondTrust Privileged Remote Access allows unauthenticated command execution.
  • Persistence Tactics: Threat actors are leveraging legitimate RMM tools like SimpleHelp, often renamed to evade detection.
  • Widespread Targeting: Simultaneous exploits are hitting Google Chrome (CVE-2026-2441) and Ivanti infrastructure via bulletproof hosts.
  • Hardware Deception: The Starlink “brick mode” incident highlights how GPS and hardware IDs can be weaponized through social engineering.

Table of Contents

Technical Analysis of the BeyondTrust Exploitation

Analysis of recent threat intelligence indicates that threat actors are actively leveraging a critical vulnerability in BeyondTrust Privileged Remote Access (PRA). The vulnerability, tracked under a critical CVSS score of 9.9, allows for unauthenticated remote code execution (RCE). The Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that exploitation in the wild: critical BeyondTrust flaw (CVSS 9.9) opens door to network takeover.

Cybersecurity dashboard showing BeyondTrust RCE exploit activity

Persistence via RMM Hijacking

Observed attack patterns indicate that initial access is frequently followed by the deployment of legitimate Remote Monitoring and Management (RMM) tools to bypass traditional breach detection. Specifically, adversaries are deploying SimpleHelp, a legitimate RMM platform, to maintain a persistent foothold. To evade detection by security operations centers (SOCs), threat actors are renaming these binaries to inconspicuous strings, such as remote access.exe. These binaries are typically executed from the C:\ProgramData root directory under the SYSTEM account, providing the highest level of local privilege.

Internal Reconnaissance and Credential Escalation

Following the establishment of persistence, attackers move into a discovery phase. Intelligence suggests the use of AdsiSearcher, a .NET class, to perform automated inventories of Active Directory (AD) computers. Standard command-line utilities including systeminfo and ipconfig are used to map the network architecture and identify further targets for lateral movement.

A primary objective observed in these campaigns is the acquisition of administrative control. Attackers have been documented executing commands to modify high-privilege groups directly:

  • net group "enterprise admins" [USERNAME] /add /domain
  • net group "domain admins" [USERNAME] /add /domain

Lateral Movement and Tooling

For movement across the internal environment, adversaries utilize PSexec to distribute the RMM infection. Additionally, the use of Impacket for SMBv2 session requests has been noted, allowing attackers to manipulate network services and harvest credentials. This phase often utilizes a cyber threat intelligence platform to identify and target high-value assets within the compromised perimeter.

Chrome Zero-Day: CVE-2026-2441

Simultaneous to the BeyondTrust exploitation, a high-severity zero-day vulnerability in Google Chrome, tracked as CVE-2026-2441, is being actively targeted. This vulnerability resides in the browser’s CSS component and is categorized as a “Use-After-Free” memory corruption error.

The flaw occurs when the browser continues to use a pointer to a memory address after that memory has been deallocated. Attackers can exploit this “dangling pointer” by populating the freed memory space with malicious data.

Google has released updates to address this flaw. Organizations must ensure endpoints are updated to the following versions:

  • Windows & Mac: 145.0.7632.75/.76
  • Linux: 144.0.7559.75

Odido Data Breach: Impact and Exfiltration

Infrastructure vulnerabilities often lead to large-scale data exfiltration, as evidenced by the Odido breach reported on February 14, 2026. This incident resulted in the exposure of 6.2 million customer records. This data is frequently sold through a dark web monitoring service or used in highly targeted phishing campaigns. The breach reinforces the requirement for comprehensive breach detection systems that monitor for unauthorized access to sensitive databases.

Ivanti RCE Exploitation Patterns

Recent telemetry reveals that a single threat actor is responsible for approximately 83% of the active exploitation of two critical Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities: CVE-2026-21962 and CVE-2026-24061. These flaws allow for unauthenticated code injection and RCE.

The majority of this activity originates from a single IP address: 193.24.123.42, hosted by a known “bulletproof” autonomous system. Exploitation is highly automated, utilizing over 300 different user agents to rotate requests. Furthermore, 85% of the exploitation sessions used OAST-style (Out-of-Band Application Security Testing) DNS callbacks. Integrating a live ransomware API can help organizations track these precursors to deployment.

In a distinct theater of digital conflict, social engineering and technical deception were used to neutralize 2,420 unauthorized Starlink terminals. Ukrainian entities created fake Telegram “activation bots” that promised to bypass whitelisting restrictions for Starlink hardware. To “activate” the terminals, users provided Hardware Serial Numbers (SN) and GPS/GNSS Data.

Once the Serial Number and GPS coordinates were harvested, the hardware could be remotely disabled or “bricked.” Organizations must understand that hardware identifiers are inseparable from location data in modern electronic warfare, requiring robust telegram threat monitoring to prevent personnel from falling for such traps.

Strategic Defensive Actions

Based on the research findings regarding BeyondTrust, Ivanti, and Chrome, the following technical steps are required for mitigation:

  • Isolate RMM Traffic: Monitor for the execution of RMM tools like SimpleHelp from non-standard directories like \ProgramData\.
  • DNS Monitoring: Configure network monitoring to flag unusual DNS callbacks, which often signal initial access brokers verifying RCE.
  • Privilege Auditing: Implement real-time alerting for any unauthorized additions to Domain Admins or Enterprise Admins groups.
  • Patch Management: Prioritize BeyondTrust PRA (v24.3.4+) and Ivanti EPMM updates immediately.
  • Supply-Chain Risk: Use an underground forum intelligence service to determine if corporate credentials are being traded.

PurpleOps Expertise and Services

The current threat environment requires more than passive defense. PurpleOps provides the specialized intelligence and technical operations needed to counter unauthenticated RCE and persistence tactics used in the BeyondTrust and Ivanti campaigns.

Our Cyber Threat Intelligence services provide real-time ransomware intelligence, allowing your team to see the precursors of an attack before encryption begins. For organizations managing complex perimeters, our Dark Web Monitoring identifies when assets are targeted by initial access brokers.

PurpleOps also addresses lateral movement through Penetration Testing and Red Team Operations, simulating techniques like AdsiSearcher reconnaissance. Furthermore, our focus on Supply Chain Information Security ensures third-party vulnerabilities in tools like BeyondTrust are identified before they result in a network takeover.

Frequently Asked Questions

What is the severity of the BeyondTrust PRA vulnerability?
The vulnerability is rated as critical with a CVSS score of 9.9, as it allows unauthenticated attackers to execute remote code on the appliance.

How are threat actors maintaining persistence after exploiting BeyondTrust?
Adversaries are deploying legitimate RMM tools like SimpleHelp, often renaming the binaries to things like remote access.exe and running them from C:\ProgramData to hide from security tools.

What is a Use-After-Free vulnerability in Chrome?
It is a memory corruption error where the browser attempts to use a memory pointer after it has been freed. Attackers can fill that memory space with malicious code to gain execution.

How can I protect my organization from Ivanti RCE attacks?
Immediately apply vendor patches or RPM packages. Additionally, monitor for OAST-style DNS callbacks and traffic from known bulletproof IP addresses like 193.24.123.42.

What did the Starlink incident teach about digital security?
It demonstrated that hardware identifiers (SN) and GPS data are highly sensitive. Using unauthorized third-party bots or services for “activation” can lead to hardware being bricked or physical locations being compromised.