PostgreSQL flaw exploited as zero-day in BeyondTrust breach

​Rapid7's vulnerability research team says attackers exploited a PostgreSQL security flaw as a zero-day to breach the network of privileged access management company BeyondTrust in December. BeyondTrust revealed that attackers breached its systems and 17 Remote Support SaaS instances in early December using two zero-day bugs (CVE-2024-12356 and CVE-2024-12686) and a stolen API key. Less than one month later, in early January, the U.S. Treasury Department disclosed that its network was breached by threat actors who used a stolen Remote Support SaaS API key to compromise its BeyondTrust instance. Since then, the Treasury breach has been linked to Chinese state-backed hackers tracked as Silk Typhoon, a cyber-espionage group involved in reconnaissance and data theft attacks that became widely known after hacking an estimated 68,500 servers in early 2021 using Microsoft Exchange Server ProxyLogon zero-days. The Chinese hackers specifically targeted the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments for national security risks, and the Office of Foreign Assets Control (OFAC), which administers trade and economic sanctions programs. They also hacked into the Treasury's Office of Financial Research systems, but the impact of this incident is still being assessed. Silk Typhoon is believed to have used their access to Treasury's BeyondTrust instance to steal "unclassified information relating to potential sanctions actions and other doc...