업데이트: Arctic Wolf는 CVE-2026-1731 PoC 공개 이후 BeyondTrust Remote Support를 타겟으로 하는 위협 캠페인을 관찰합니다
팔로우
Detection stack
- AIDR
- Alert
- ETL
- Query
요약
Arctic Wolf는 BeyondTrust 원격 지원 및 특권 원격 액세스 배포를 대상으로 CVE-2026-1731의 개념 증명을 악용하는 야생의 위협 캠페인을 보고합니다. 이 결함은 영향을 받는 시스템에서 인증되지 않은 OS 명령 삽입을 가능하게 합니다. 지금까지 관찰된 활동은 PoC 릴리스 이후 노출된 원격 지원 인프라의 기회적 악용에 중점을 둔 것으로 보입니다.
조사
조사 결과, Arctic Wolf는 CVE-2026-1731에 취약한 자체 호스팅 BeyondTrust 원격 지원 인스턴스에 대한 악용 시도와 관련된 의심스러운 행동과 PoC 스타일의 악용과 일치하는 네트워크 패턴 및 명령 실행 원격 측정치를 발견했습니다. 보고서에서는 추가로 드롭된 멀웨어나 후속 페이로드 아티팩트와 관련된 추가 정보를 공개하지 않았습니다.
완화
CVE-2026-1731에 대한 공급업체 패치를 즉시 적용하고 BeyondTrust 원격 지원 서비스에 대한 네트워크 액세스를 신뢰할 수 있는 관리자 네트워크로 제한하여 노출을 줄이십시오. 특히 인터넷을 마주하는 장치 및 관리 인터페이스에서 예상치 못한 명령 실행 및 비정상적인 원격 세션 동작 모니터링을 강화하십시오.
대응
악용이 의심되는 경우, 영향을 받은 호스트를 격리하고, 패치 수준을 확인하며, OS 명령 실행의 증거에 대한 포렌식 범위를 수행하십시오. 잠재적으로 노출된 자격 증명을 변경하고, 원격 액세스 로그를 검토하여 무단 세션, 수상한 운영자 동작 및 비정상적인 관리자 활동을 찾아보십시오.
공격 흐름
이 부분을 업데이트 중입니다. 알림을 받으려면 가입하세요
알림 받기시뮬레이션
이 부분을 업데이트 중입니다. 알림을 받으려면 가입하세요
알림 받기SOC Prime의 Detection as Code 플랫폼에 가입하세요 귀사의 비즈니스에 가장 중요한 위협에 대한 가시성을 개선하세요. 시작을 돕고 즉각적인 가치를 제공하기 위해 지금 SOC Prime 전문가와의 회의를 예약하세요.
This website uses cookies (small text files that are stored by the web browser on the user's device) to improve the user experience while you navigate through the website for the statistical analysis of traffic and to adapt the content of the website to your individual needs. It also lets us improve your overall experience of the website. These cookies will only be stored in your browser with your consent.
However, if you would like to, you can opt-out of these cookies in your browser settings at any time. But opting out of some of these cookies may have a negative impact on your viewing experience. More information can be found in our Cookie Policy, and for a detailed list of the cookies we use, see our Cookie Settings.
Cookie Settings
Below is a detailed list of the cookies we use on our Site. We classify cookies in the following categories:
Strictly Necessary Cookies
Cannot be switched off in our systems. They are usually only set in
response to actions made by you which amount to a request for services,
such as setting your privacy preferences, logging in or filling in forms.
You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
| Name | Descripiton |
|---|---|
| PHPSESSID | Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages. |
| sp_i | Used to store information about authenticated User. |
| sp_r | Used to store information about authenticated User. |
| sp_a | Used to store information about authenticated User. |
Performance Cookies
These cookies allow us to count visits and traffic sources so we can
measure and improve the performance of our site. They help us to know
which pages are the most and least popular and see how visitors move
around the site.
All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
| Name | Descripiton |
|---|---|
| tuuid | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded. |
| tuuid_last_update | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded. |
| um | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded. |
| umeh | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded. |
| na_sc_x | Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site. |
| APID | Collects anonymous data related to the user's visits to the website. |
| IDSYNC | Collects anonymous data related to the user's visits to the website. |
| _cc_aud | Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising. |
| _cc_cc | Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising. |
| _cc_dc | Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising. |
| _cc_id | Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising. |
| dpm | Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads. |
| acs | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads. |
| clid | Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads. |
| KRTBCOOKIE_# | Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads. |
| PUBMDCID | Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads. |
| PugT | Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads. |
| ssi | Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads. |
| _tmid | Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips. |
| wam-sync | Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website. |
| wui | Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website. |
| AFFICHE_W | Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website. |
| B | Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor. |
| 1P_JAR | These cookies are used to gather website statistics, and track conversion rates. |
| APISID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| HSID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| NID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| SAPISID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| SID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| SIDCC | Security cookie to protect users data from unauthorised access. |
| SSID | Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users. |
| __utmx | This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website. |
| __utmxx | This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website. |
Functional Cookies
These cookies enable the website to provide enhanced functionality and personalisation.
They may be set by us or by third party providers whose services we have added to our
pages.
If you do not allow these cookies then some or all of these services may not function properly.
If you do not allow these cookies then some or all of these services may not function properly.
| Name | Descripiton |
|---|---|
| _hjid | Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID. |
| _hjIncludedInSample | This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample. |
| intercom-id-[xxx] | This cookie is used by Intercom as a session so that users can continue a chat as they move through the site. |
| intercom-session-[xxx] | Used to keeping track of sessions and remember logins and conversations. |
| demdex | Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads. |
| CookieConsent | Stores the user's cookie consent state for the current domain. |
| __cfduid | Used by the content network, Cloudflare, to identify trusted web traffic. |
| ss | These cookies enable the website to provide enhanced functionality and
personalisation . They may be set by us or by third party providers whose
services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality . |
Targeting Cookies
These cookies may be set through our site by our advertising partners.
They may be used by those companies to build a profile of your interests
and show you relevant adverts on other sites.
They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
| Name | Descripiton |
|---|---|
| _ga | This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners. |
| _gat | Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes. |
| _gid | This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. |
| IDE | Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user. |
| r/collect | Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user. |
| test_cookie | Used to check if the user's browser supports cookies. |
| collect | Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels. |
| ads/user-lists/# | These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. |
| c | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |
| khaos | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |
| put_# | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |
| rpb | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |
| rpx | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |
| tap.php | Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network. |