{"id":78,"date":"2026-02-27T04:12:59","date_gmt":"2026-02-27T04:12:59","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=78"},"modified":"2026-02-27T04:12:59","modified_gmt":"2026-02-27T04:12:59","slug":"beyondtrust-flaw-used-for-web-shells-backdoors-and-data-exfiltration","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=78","title":{"rendered":"BeyondTrust Flaw Used for Web Shells, Backdoors, and Data Exfiltration"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Feb 20, 2026<\/span><\/span>Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors have been observed exploiting a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products to conduct a wide range of malicious actions, including deploying VShell and\u00a0<\/p>\n

The vulnerability, tracked as CVE-2026-1731<\/strong> (CVSS score: 9.9), allows attackers to execute operating system commands in the context of the site user.<\/p>\n

In a report published Thursday, Palo Alto Networks Unit 42 said<\/a> it detected the security flaw being actively exploited in the wild for network reconnaissance, web shell deployment, command-and-control (C2), backdoor and remote management tool installs, lateral movement, and data theft.<\/p>\n

The campaign has targeted financial services, legal services, high technology, higher education, wholesale and retail, and healthcare sectors across the U.S., France, Germany, Australia, and Canada.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The cybersecurity company described the vulnerability as a case of sanitization failure that enables an attacker to leverage the affected \u00abthin-scc-wrapper\u00bb script that’s reachable via WebSocket interface to inject and execute arbitrary shell commands in the context of the site user.<\/p>\n

\u00abWhile this account is distinct from the root user, compromising it effectively grants the attacker control over the appliance’s configuration, managed sessions and network traffic,\u00bb security researcher Justin Moore said.<\/p>\n

\"\"<\/a><\/div>\n

The current scope of attacks exploiting the flaw range from reconnaissance to backdoor deployment –<\/p>\n