Two intrusions. Two vendors. Same playbook.
Ivanti Connect Secure. Volexity says an unknown actor it tracks as UTA0576 started exploiting a zero-day chain on Oct 3 against an appliance that was fully patched at the time, version 22.8R2.4. Three bugs were chained. First, an authentication bypass: a request to the public welcome.cgi carries a spoofed X-DSCGI-PATH header that routes it to a protected script. Second, a file-write race in wu.cgi. Third, a privilege escalation through the dsinvoked broker trusting DSCache. The result is unauthenticated root. Ivanti tracks the bypass and RCE as CVE-2026-104935, patched Oct 13. The privilege escalation fix is due in a future release (per Volexity). CISA added the CVE to KEV the same day.
BeyondTrust Remote Support. On Oct 15, BeyondTrust disclosed CVE-2026-102764 (BT26-05, CVSS v4 9.3). It’s improper origin validation in an internal messaging component, and it allows file operations on the appliance. Mandiant attributes zero-day use in late August to ARMORY CASTLE, the suspected PRC-nexus actor formerly tracked as UNC5221. Per BeyondTrust’s timeline, the actor hit one BeyondTrust-hosted instance and one self-hosted appliance on Aug 29. SaaS was auto-patched by Oct 9. Self-hosted Remote Support through 26.2.3 needs the BT26-05-RS patch.
What both actors wanted. Not the box. What the box knows. UTA0576 pulled LDAP credentials stored on the VPN. Then it used the appliance’s own Active Directory service account to search for LAPS passwords, BitLocker recovery keys and password-bearing attributes. It also parsed packet captures already on the box for plaintext LDAP, HTTP Basic and NTLM material (per Volexity). ARMORY CASTLE dropped a webshell, built a SUID root shell and tried to dump the appliance vault with BeyondTrust’s own bt-secrets CLI. Then it raised Jump Item roles to Administrator and used native support sessions to pull files off downstream desktops (per Mandiant).
Then both cleaned up. UTA0576 rewrote debug and audit logs and patched a library in memory only. That’s why Ivanti’s Integrity Checker Tool doesn’t flag it. ARMORY CASTLE deleted appliance and web server logs. If your only evidence lives on the appliance, assume someone edited it.
The uncomfortable detail. BeyondTrust says its sensors fired in real time when the actor escalated privileges. The automated triage layer in its third-party detection platform closed those alerts as false positives. A threat-intel-driven hunt found the intrusion on Sep 28 instead. Any SOC buying auto-triage should sit with that for a minute.
What we’d do this week.
1. Patch, then assume nothing. Move ICS to the fixed build. Apply BT26-05 on self-hosted Remote Support, and on Privileged Remote Access too, since it shares the affected code (BeyondTrust’s advice). Any appliance that was internet-reachable and unpatched during the window should be treated as compromised until reviewed. Rebuild it, don’t clean it (per Mandiant).
2. Shrink what the appliance identity can read. A VPN’s directory bind account has no business reading LAPS passwords or BitLocker recovery keys. Audit who holds read rights on those attributes and strip the appliance accounts. It’s a small ACL change, and it would have taken the worst step out of the Ivanti intrusion.
3. Get logs off the box. Send syslog to the SIEM in near real time, and log at a reverse proxy or WAF in front of the appliance. Alert on forwarding gaps that start and end inside a single session. From the outside, that’s what log tampering looks like.
4. Hunt the mismatches. At the proxy, look for requests to welcome.cgi whose X-DSCGI-PATH points somewhere else. On BeyondTrust, look for user_changed events that raise Jump Item or Team roles, plus admin logins from residential or commercial VPN address space.
5. Set a triage rule. No auto-close on high-severity signals from privileged infrastructure without a human looking.
The AI footnote. Volexity assesses with medium confidence that UTA0576 uses LLMs for exploit development and post-exploitation. BeyondTrust plans as though ARMORY CASTLE keeps an AI model of target products, while saying it has no forensic proof. Treat both as working assumptions, not findings. Either way, the gap between disclosure and mass exploitation keeps shrinking.
The buyer angle. BeyondTrust’s SaaS customers got patched on BeyondTrust’s clock. Self-hosted customers patch on their own. In practice that gap matters more than most rows in a feature RFP. And both of these products were bought to make access safer. Price them as tier-zero assets, because attackers already do.