Threat actors began exploiting a critical vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support solutions to deploy persistent web shells and backdoors. The flaw, tracked as CVE-2025-5231, is a command injection vulnerability that allows unauthenticated attackers to execute code with elevated privileges.
Attack Lifecycle
- Initial Access: Attackers exploit the vulnerability via the appliance’s web interface, bypassing authentication to gain a foothold.
- Payload Deployment: Once inside, adversaries deploy custom web shells to maintain persistent access. In several cases, they installed the “Spark” backdoor, which allows for file exfiltration and remote command execution.
- Data Exfiltration: High-profile targets have reported the theft of sensitive credentials and session logs. The Mandiant team observed attackers using these credentials to pivot deeper into corporate networks.
Indicators of Compromise (IOCs)
Security teams should monitor for:
- Unexpected modifications to the
/home/bomgar/ or /usr/bin/ directories.
- Outbound traffic to known malicious IPs associated with the Spark C2 infrastructure.
- Unauthorized creation of local accounts or changes to LDAP/AD integration settings within the appliance.
Remediation
BeyondTrust has released emergency patches. Organizations using on-premises or virtual appliances must:
- Apply Patches: Immediately update to the latest maintenance release via the BeyondTrust Support Portal.
- Audit Sessions: Review all administrative sessions and credential access logs from the past 30 days.
- Rotate Credentials: Change all passwords for accounts managed by or stored within the compromised appliance.
