On 2 December 2024, BeyondTrust, a privileged access management vendor, detected anomalous behaviour affecting some customer instances of its Remote Support SaaS product. By 5 December its investigation had found that an API key for Remote Support SaaS had been compromised, one that allowed password resets for local application accounts on customer instances. BeyondTrust revoked the key, suspended the affected instances and notified customers. One of them was the US Department of the Treasury. In a letter to lawmakers, the Treasury said a China state-sponsored threat actor had used the stolen key to "override the service's security" and remotely access some Treasury user workstations and unclassified documents, which it classed as a major incident. During its investigation BeyondTrust also found two vulnerabilities in its remote access products; CISA added one, CVE-2024-12356, to its list of exploited vulnerabilities.
Key takeaways
- A single infrastructure API key for BeyondTrust's Remote Support SaaS could reset local application passwords on customer instances, and it was compromised.
- The Treasury says the attacker used the key to override the remote support service's security and reach Departmental Offices workstations and unclassified documents.
- The Treasury attributed the attack to a China state-sponsored APT; CISA later said the Treasury was the only US federal agency affected.
- BeyondTrust found two vulnerabilities in its Remote Support and Privileged Remote Access products, and CISA says CVE-2024-12356 was exploited; how the key was stolen was not explained in the sources we could read.
- The identity lesson: a vendor's own infrastructure keys can be keys to its customers, especially for tools that exist to give remote privileged access.
At a glance
| Organisations | BeyondTrust (Remote Support SaaS); US Department of the Treasury and a limited number of other Remote Support SaaS customers |
|---|---|
| When | Anomalous behaviour detected 2 December 2024; compromised key identified 5 December; Treasury notified 8 December; Treasury disclosure 30 December 2024 |
| Attacker | A China state-sponsored advanced persistent threat actor, according to the Treasury |
| Entry point | A compromised Remote Support SaaS API key; two vulnerabilities in BeyondTrust remote access products were found during the investigation |
| Identities abused | A BeyondTrust infrastructure API key able to reset local application account passwords on customer instances; local application accounts on those instances |
| Impact | Remote access to some Treasury Departmental Offices workstations and unclassified documents; affected customer instances suspended |
| Category | NHI. Incident class: confirmed NHI breach (stolen vendor API key used to reach customers) |
What happened
BeyondTrust told customers that on 2 December 2024 it detected "anomalous behavior" and found that some Remote Support SaaS instances were compromised. "On December 5th, 2024, a root cause analysis into a Remote Support SaaS issue identified an API key for Remote Support SaaS had been compromised," it said, as quoted by BleepingComputer. The key "allowed for password resets of local application accounts," according to Help Net Security. "BeyondTrust immediately revoked the API key, notified known impacted customers, and suspended those instances the same day while providing alternative Remote Support SaaS instances for those customers."
The Treasury was one of those customers. In a letter to the Senate Banking Committee, reported by TechTarget, it wrote: "On December 8, 2024, Treasury was notified by a third-party software service provider, BeyondTrust, that a threat actor had gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able override the service's security, remotely access certain Treasury DO user workstations." The Treasury took the service offline, said it had found no evidence of continued access, and attributed the incident to "a China state-sponsored Advanced Persistent Threat (APT) actor." Help Net Security, citing The New York Times, reported that workstations in the Office of Financial Research and the Office of Foreign Assets Control were compromised. China's foreign ministry disputed the attribution.
While investigating, BeyondTrust found two vulnerabilities in its Remote Support and Privileged Remote Access products: CVE-2024-12356, a critical command injection flaw that lets an unauthenticated attacker run operating system commands, and CVE-2024-12686, which requires admin privileges. It patched all SaaS instances and released fixes for self-hosted ones. CISA says CVE-2024-12356 has been exploited. BeyondTrust did not tell BleepingComputer whether the flaws were used to breach its SaaS instances, and the sources we could read do not explain how the API key was stolen. On 6 January 2025, CISA said the Treasury was the only US federal agency affected.
Timeline
| Date | Event |
|---|---|
| 2 December 2024 | BeyondTrust detects anomalous behaviour affecting some Remote Support SaaS instances. |
| 5 December 2024 | BeyondTrust identifies the compromised API key, revokes it and suspends affected instances. |
| 8 December 2024 | BeyondTrust notifies the Treasury and publishes a security advisory. |
| 16 December 2024 | BeyondTrust identifies CVE-2024-12356 during its investigation; a second flaw, CVE-2024-12686, follows on 18 December. |
| 30 December 2024 | The Treasury's letter to lawmakers describing a major incident becomes public. |
| 6 January 2025 | CISA says the Treasury was the only federal agency affected. |
How it happened: the identity attack path
- Vendor key compromised. An API key for BeyondTrust's Remote Support SaaS infrastructure fell into an attacker's hands; the route is not stated in the sources we read.
- Key with customer reach. The key could reset passwords for local application accounts on customer Remote Support instances.
- Customer instances taken over. The attacker used it against a limited number of customers' instances, including the Treasury's.
- Remote access to endpoints. Through the remote support service, the attacker reached Treasury user workstations and unclassified documents.
- Containment. The key was revoked, instances suspended and the Treasury's service taken offline.
Impact
- Treasury: remote access to certain Departmental Offices workstations and unclassified documents; classed as a major incident.
- Other customers: a limited number of Remote Support SaaS customers had instances compromised and were moved to new instances.
- Vulnerabilities: CVE-2024-12356 and CVE-2024-12686 patched; CVE-2024-12356 exploited, according to CISA.
What this means for NHI governance
Remote support and privileged access tools exist to give trusted people deep access to endpoints. The vendor running them in the cloud therefore holds infrastructure credentials with enormous reach across its customers. Here, one API key could reset account passwords on customer instances, which turned the theft of a single machine credential into access to a government department's workstations.
For vendors, keys with cross-customer reach need the strongest protection: tight scoping, short lives, isolation and anomaly detection. For customers, remote access and PAM providers are tier-zero suppliers: limit which accounts their service can control, log every session and be able to switch the service off quickly. See our Third-Party Access Guide, Privileged Access Management Guide and API Key Management Guide.
Recommendations
- Treat remote access and PAM vendors as tier-zero suppliers. Assess how they protect infrastructure keys and how fast they can revoke them. See the Third-Party Access Guide.
- Scope infrastructure API keys narrowly. No single key should be able to reset accounts across many customers. See our API Key Management Guide.
- Log and review remote support sessions. Record who connected to which endpoint and alert on sessions outside normal support patterns. See the Privileged Session Management Guide.
- Patch remote access products fast. Internet-facing remote support tools are prime targets; apply fixes for exploited flaws immediately.
- Plan to disable a vendor service quickly. Know how to take a compromised remote access service offline without losing the ability to support users.
Frequently asked questions
How was the US Treasury hacked in December 2024?
A China state-sponsored actor used a stolen key for BeyondTrust's cloud-based remote support service to override its security and remotely access some Treasury user workstations and unclassified documents, according to the Treasury.
What did the compromised BeyondTrust API key allow?
It allowed password resets of local application accounts on customer Remote Support SaaS instances, which gave the attacker control of those instances.
Were BeyondTrust vulnerabilities involved?
BeyondTrust found two vulnerabilities, CVE-2024-12356 and CVE-2024-12686, during its investigation and patched them. CISA says CVE-2024-12356 was exploited, but the sources we read do not say how it relates to the stolen key.
Related NHI Mgmt Group resources
JumpCloud Breach 2023 · Salt Typhoon Telecom Breaches · Privileged Access Management Guide · Third-Party Access Guide · API Key Management Guide
How NHI Mgmt Group can help
Privileged access vendors hold some of the most powerful machine credentials in any supply chain. We help teams assess those suppliers, limit what their services can control and prepare to cut them off in an incident. See our NHI and AI agent security training.