Analysis: detecting a BeyondTrust intrusion after the logs were wiped

A breakdown of the BeyondTrust compromise via CVE-2026-102764: attackers deleted system, web and application logs, so detection must rely on firewalls, proxies and downstream session records. ZoomEye scans on October 23 found 966 assets with a BeyondTrust title, 226 of them Privileged Remote Access.

• Attackers wiped system, web and application logs on the BeyondTrust appliance
• ZoomEye: 966 assets titled BeyondTrust, 226 Privileged Remote Access
• Persistence via config templates and permissions survives a reboot
• Detection relies on firewall, proxy and downstream session logs