Active Exploitation of BeyondTrust Remote Support RCE (CVE-2026-1731) to Deploy VShell and SparkRAT

BeyondTrust Remote Support is being actively exploited via CVE-2026-1731, a critical pre-authentication OS command injection / RCE flaw (CVSS 9.9) in the thin-scc-wrapper component exposed to the internet via WebSocket. Reporting indicates attackers can execute system commands without logging in, enabling rapid progression from initial access to full compromise, including reconnaissance, account creation, webshell deployment, C2 activity, lateral movement, and data theft. Victimology described to date spans multiple sectors—financial services, healthcare, legal services, higher education, and technology/retail—across the U.S., France, Germany, Australia, and Canada, with telemetry indicating 10,600+ exposed instances potentially at risk.

Threat activity observed in exploitation includes deployment of two prominent remote-access backdoors: VShell (noted for stealthy, service-like behavior and fileless/memory execution on Linux) and SparkRAT (an open-source Go-based RAT previously seen in campaigns linked to DragonSpark). Due to confirmed exploitation, CISA added CVE-2026-1731 to the KEV Catalog (Feb. 13, 2026), signaling urgent patching/mitigation prioritization. Separate reporting in the same period covered unrelated critical issues in GNU Inetutils telnetd (CVE-2026-24061) and an exploitation surge affecting Ivanti products (CVE-2025-0282/CVE-2025-0283), but those are distinct from the BeyondTrust activity.