Tag: CVE-2026-1731

3 Attack Reports | 1 Vulnerabilities

Attack reports

Uptick in Bomgar RMM Exploitation

Since early April 2026, security researchers have observed a significant increase in attacks targeting Bomgar remote monitoring and management instances, exploiting CVE-2026-1731, a critical vulnerability disclosed in February. Threat actors have compromised Bomgar RMM to target downstream customer…
screenconnect
ransomware
lockbit
anydesk
byovd
remote access tools
simplehelp
atera
CVE-2026-1731
2026-04-17
bomgar
msp targeting
poisonkiller
rmm exploitation
Published: April 17, 2026
Linked vulnerabilities : CVE-2026-1731 (CVSS 9.9)
Downloadable IOCs: 5

MuddyWater Exposed: Inside an Iranian APT operation

Researchers identified and analyzed exposed infrastructure of MuddyWater, an Iranian cyber espionage group linked to the Ministry of Intelligence and Security. The investigation revealed their reconnaissance methods, exploitation of vulnerabilities, custom command and control frameworks, and exfilt…
exfiltration
cyber espionage
reconnaissance
CVE-2022-42475
vulnerability exploitation
command and control
CVE-2024-55591
CVE-2025-5777
CVE-2025-54068
iranian apt
CVE-2025-9316
CVE-2025-55182
CVE-2025-34291
CVE-2025-68613
CVE-2025-52691
tsundere botnet
CVE-2026-1281
CVE-2026-1731
geopolitical conflict
2026-03-05
arenac2
CVE-2024-23113
keyc2
mois
persianc2
Published: March 5, 2026
Linked vulnerabilities : CVE-2024-5559 (CVSS 6.1), CVE-2024-55591 (CVSS 9.8), CVE-2022-42475, CVE-2025-5777 (CVSS 9.3), CVE-2025-54068 (CVSS 9.2), CVE-2025-9316 (CVSS 6.9), CVE-2025-55182 (CVSS 10.0), CVE-2025-34291 (CVSS 9.4), CVE-2025-68613 (CVSS 9.9), CVE-2025-52691 (CVSS 10.0), CVE-2026-1281 (CVSS 9.8), CVE-2026-1731 (CVSS 9.9), CVE-2024-23113
Downloadable IOCs: 14

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

A critical remote code execution vulnerability (CVE-2026-1731) in BeyondTrust remote support software is being actively exploited. The flaw allows unauthenticated attackers to execute arbitrary OS commands with high privileges. Observed attacker activities include network reconnaissance, account cr…
data theft
lateral movement
webshell
sparkrat
remote code execution
vshell
CVE-2026-1731
2026-02-20
beyondtrust
Published: February 20, 2026
Linked vulnerabilities : CVE-2026-1731 (CVSS 9.9)
Downloadable IOCs: 14
Click here to see more Attack Reports

Vulnerabilities

CVE-2026-1731

9.9
    Beyondtrust
  • Beyondtrust Remote Support
  • Privileged Remote Access
Published: February 6, 2026
Click here to see more Vulnerabilities