Mandiant: ARMORY CASTLE abused BeyondTrust remote-support sessions

Mandiant reports that ARMORY CASTLE used a compromised BeyondTrust Remote Support appliance to move through networks. CISA urges forwarding appliance syslog and session events to a SIEM immediately, while Mandiant recommends redeploying Jump Clients and tokens from a rebuilt appliance.

• Appliance-local logs sit on an encrypted partition and stay uncentralised without forwarding
• CISA says to send syslog and session events to the SIEM along with WAF and proxy logs
• Mandiant advises redeploying Jump Clients and tokens from a patched appliance
• The gap between intrusion and disclosure was measured in weeks