how it happened
- whoChina state actorstolen API key
- the gapremote support tooltrusted vendor plumbing
- the resultTreasury workstationsunclassified documents
what everyone assumed
A username and password feels like a credential because a person types it. An API key feels like configuration: a string in a settings field that makes an integration function. That difference is intuitive and almost everywhere, which is why API keys are often held to a lighter standard than the passwords they sit beside, even when they unlock more.
what happened
A stolen key for BeyondTrust’s Remote Support service, combined with a critical command-injection flaw later tracked as CVE-2024-12356, let an attacker reach past the service’s own protections. With that access, the actor could operate against the workstations the support tool was connected to. The activity used the legitimate plumbing of a trusted vendor, so it did not announce itself as an intrusion. BeyondTrust has not said publicly how the key came to be exposed.
step by step
- a key for BeyondTrust Remote Support is stolenHow is not public.
- combined with a command-injection flawCVE-2024-12356 gets past the service's protections.the assumption breaks here
- Treasury workstations reached through trusted plumbingUnclassified documents accessed.
- 8 December 2024Treasury notified, key revokedAttributed to a China state-sponsored actor.
how it surfaced
BeyondTrust notified the Treasury on December 8, 2024. Using the stolen key, the attacker had remotely accessed certain Treasury workstations and a number of unclassified documents held by those users. The US government attributed the activity to a China state-sponsored actor. BeyondTrust shut down the affected instances and revoked the key.
A key that authenticates with no person and no second factor is among the most powerful credentials a system holds, precisely because nothing stands between it and the door.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAttackers use the trusted support tool to reach your staff's machines.what it costs youThey read documents on those machines, through software you installed to help people.
- or it goes like thisit happenedKaseya VSA, 2021howYour IT provider's remote-management tool is broken into.what leavesevery computer it manageswho ends up with ita ransomware crew hitting all its clients at once
- or it goes like thisit happenedOkta / Lapsus$, 2022howA support contractor's laptop is taken over for a short while.what leavesreach into customer accountswho ends up with itan extortion gang posting screenshots
sources
your turn
what you can do about it
this week
List the API keys and service tokens with the broadest reach, and for each one ask three questions: when was it last rotated, who would notice if it were used at 3am, and what is the single most sensitive thing it can touch.
Your environment runs on keys you have never rotated: the token in the CI pipeline, the integration secret in the SaaS connector, the service account that "just needs to work." The assumption to retire is that a key is configuration rather than a credential, because the systems it opens cannot tell the difference and neither can an attacker holding it.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →