Morning Threat Brief: The Support Tool That Became a Skeleton Key

Good morning. Today's theme is uncomfortable: the tools you trust with the most privilege are the ones attackers want most.

A suspected Chinese espionage group owned BeyondTrust Remote Support for seven weeks

BeyondTrust disclosed CVE-2026-102764 on October 15, a critical improper origin validation flaw (CVSS 9.3) in internal messaging components of Remote Support, the tool IT teams use to reach into endpoints. An unauthenticated attacker can perform file operations on the appliance, leading to host control and access to every credential the appliance stores or brokers. Mandiant and Google Threat Intelligence attribute exploitation since late August 2026 to ARMORY CASTLE (formerly UNC5221, tracked by CrowdStrike as WARP PANDA). The actor planted the SAWFLY PHP web shell, escalated to root, tried to dump the appliance secrets vault, deployed the BARECLAW SOCKS5-over-WebSocket tunnel through the HAProxy config, and deleted logs. CISA added the CVE to KEV on October 16; federal agencies must remediate by October 19.

What to do: patch BT26-05-RS immediately (versions up to 26.2.3 are affected), then treat every exposed appliance as potentially compromised. Hunt SAWFLY artifacts, unexpected root SUID shells, boot scripts granting passwordless sudo, HAProxy changes, Jump Item roles raised to Administrator, and log gaps. Rotate every credential the appliance brokered.

PEERSTITCH: a memory-resident implant on firewalls, via a new Fortinet flaw

CISA also added CVE-2025-61624 to KEV on October 16: a path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that lets an authenticated attacker with admin rights write or delete arbitrary files via specific CLI commands. Palo Alto Networks Unit 42 reports attackers exploited the flaw in the FortiOS auto-script engine to deploy PEERSTITCH, a memory-only implant that hooks FortiOS processes, evades detection inside FortiOS memory, and bypasses security checks on tagged VPN sessions. It opens no ports and makes no outbound connections. Separately, Unit 42 traced a campaign in which a telecom provider's FortiManager was breached, exposing configurations, credentials, and private keys for more than 500 FortiGate firewalls.

What to do: patch per Fortinet FG-IR-26-122 by the October 19 federal deadline. Hunt rogue FortiManager registrations, unexpected auto-script objects, and the network and file indicators in the IoC library.

Supply-chain compromise hits Rank Math SEO PRO for WordPress

Attackers trojanized a subset of Rank Math SEO PRO 3.0.123 packages served between October 15 at 20:02 UTC and October 16 at 07:12 UTC (CVE-2026-111862, CVSS 9.8). Activating the plugin executes embedded malware: it beacons to rank1cdn.com, plants hidden PHP backdoors, creates rogue admin accounts, drops PHP-executable .cache files and a fake WordPress core file, sets a cron marker, and harvests credentials, database passwords, and API keys. Version 3.0.124 is the clean replacement.

What to do: if your site fetched 3.0.123 during the 11-hour window, update to 3.0.124 and treat the site as fully compromised. Hunt the three malicious wp_options keys, rogue admins, stray .cache files, and cron markers, then rotate every secret the web server could reach.

Full entries with huntable indicators: kevintswaney.com/vuln-watch and kevintswaney.com/ioc-library

← kevintswaney.com