سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Canonical Run ID
ACRIP-IAS-20261101T130700Z-D4B81F63
ناجح · PASS
What ran?GENERAL_DISCOVERY
From current Hot-Start and persisted IAS memory, rank identity/authentication candidates by freshness + technical impact + evidence strength + real-world exploitation + defensive value; exclude semantic duplicates before selecting the highest eligible new Topic.
Why this Topic?BeyondTrust Remote Support — Authentication Bypass → Identity-Broker / Credential-Vault Compromise
Ivanti and passkey/cloud-session candidates scored higher raw but were excluded as already-covered Topics. BeyondTrust CVE-2026-102764 selected as highest eligible NEW candidate: confirmed zero-day exploitation plus privileged remote-access credential-vault/admin/Jump Item identity-broker impact.
EVIDENCE
الأدلة وما تثبته
5 سجل
IAS-E-0012
CVE-2026-102764 (CVSS v4 9.3) affects Remote Support <=26.2.3; insufficient message-origin validation can permit remote file operations. SaaS Remote Support was patched by Oct 9; self-hosted deployments require BT26-05-RS remediation.
UNKNOWN
Supports
Critical authentication-bypass/file-operation exposure and fixed-state semantics.
Does not prove
Every vulnerable instance was exploited, widespread campaign scale, or confirmed PRA exploitation.
Confidence
غير مسجل
Context
Authentication bypass by spoofing / origin-validation failure
BeyondTrust reports exploitation of one hosted and one self-hosted Remote Support appliance on Aug 29; Mandiant independently confirmed the self-hosted incident. As of Oct 16, BeyondTrust knew only those two impacted customers and had not observed adversary activity since August; PRA shared code but no exploitation path was identified in internal testing.
UNKNOWN
Supports
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Active exploitation verified; widespread exploitation not established.","Gap ID":"CY-GAP-IAS-D4B81F63-01","Impact":"Blocks prevalence/broad post-disclosure campaign claims.","Status":"OPEN","Gap Type":"CAMPAIGN_SCALE_POST_DISCLOSURE","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-D4B81F63,CY-TOP-0301","Description":"No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T130700Z-D4B81F63","Required Evidence / Resolution":"Independent IR/CERT/provider victim telemetry or updated authoritative denominator."}
{"Notes":"Extraction attempts and downstream abuse observed; per-object success bounded.","Gap ID":"CY-GAP-IAS-D4B81F63-02","Impact":"Blocks quantitative blast-radius and universal credential-compromise claims.","Status":"OPEN","Gap Type":"CREDENTIAL_BLAST_RADIUS","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-D4B81F63","Description":"Exact credentials successfully extracted, downstream identities/endpoints accessed and data-loss denominator remain incompletely public.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T130700Z-D4B81F63","Required Evidence / Resolution":"Victim vault audit, rotation scope, downstream session/file-transfer evidence and IR outcomes."}
FOLLOW-UP
المتابعات غير المحسومة
3 مفتوحة
CAMPAIGN_SCALE_POST_DISCLOSURE
No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.
ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
OPEN
Priority: MEDIUM-HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Mandiant observed ARMORY CASTLE exploit CVE-2026-102764 as a zero-day, deploy SAWFLY and BARECLAW, delete logs, establish host persistence, attempt credential-vault extraction with bt-secrets, elevate administrative/Jump Item permissions, launch downstream remote-support sessions and use native file transfer for internal reconnaissance/data collection.
UNKNOWN
Supports
Identity-broker/credential-vault exposure, privileged remote-access abuse, persistence and downstream movement in a real intrusion.
Does not prove
Successful theft of every stored credential, universal downstream compromise, or a victim denominator.
Google GTIG / Mandiantفتح المصدرCY-T2 / Primary IR & threat-intelligence telemetry
IAS-E-0015
Canada's Cyber Centre classifies CVE-2026-102764 as Authentication Bypass by Spoofing (CWE-290), notes in-the-wild exploitation and that CISA added it to KEV on Oct 16, and urges remediation of affected Remote Support deployments.
UNKNOWN
Supports
Government-level current-state validation of active exploitation/KEV and authentication-bypass classification.
Does not prove
Victim denominator, actor identity, or downstream credential-compromise breadth.
Canadian Centre for Cyber Securityفتح المصدرCY-T1 / National CERT official alert
IAS-E-0016
NHS England issued an active-exploitation alert for CVE-2026-102764 and assessed further exploitation as highly likely, urging immediate remediation of affected BeyondTrust Remote Support deployments.
UNKNOWN
Supports
Sector defensive urgency and forward exploitation-risk context.
Does not prove
Observed post-disclosure victim count or successful compromise beyond known incidents.
NHS England Digitalفتح المصدرCY-T1 / Sector CSOC official alert
{"Notes":"Preserve source-qualified aliases.","Gap ID":"CY-GAP-IAS-D4B81F63-03","Impact":"Blocks independently multi-source actor-identity claim.","Status":"OPEN","Gap Type":"ATTRIBUTION_INDEPENDENCE","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-D4B81F63,CY-TOP-0801","Description":"ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T130700Z-D4B81F63","Required Evidence / Resolution":"Separate authoritative/provider attribution with actor-linked infrastructure/malware/operational artifacts."}
NEW — zero-day exploitation verified by affected vendor and primary IR; credential-vault/admin/Jump Item/downstream remote-access abuse establishes identity-broker impact. Public evidence does not establish widespread post-disclosure exploitation, universal credential theft, PRA exploitation or independently multi-source actor attribution.