When Your PAM Becomes the Attack Vector: How BeyondTrust's Exploitation Exposed Every Privileged Credential

On February 6, 2026, a CVSS 9.9 vulnerability in BeyondTrust's Remote Support and Privileged Remote Access platforms was publicly disclosed. Within 24 hours, exploit code was in the wild. Within 72 hours, mass exploitation was confirmed across thousands of organizations worldwide. By the time CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog and gave federal agencies three days to patch, attackers had already reached inside some of the most sensitive credential vaults on the planet.

BeyondTrust is used by roughly 75% of the Fortune 100. Its Privileged Remote Access platform is the keystone of privileged access management for thousands of enterprise and government environments. When that keystone fails, attackers don't just get a foothold. They get the keys to every system the PAM platform protects. That's the blast radius problem in a sentence: once your PAM solution becomes the attack vector, every credential it stores is at risk, and every system those credentials reach is compromised by extension.

I've sat in enough post-incident reviews to recognize the pattern, and this one is not hypothetical. It's what happened in February and March 2026. And it exposes a structural flaw in how most organizations reason about privileged access.

The Attack Nobody Should Have Been Able to Pull Off

CVE-2026-1731 is a pre-authentication remote code execution vulnerability. No credentials required. No user interaction needed. Low complexity to exploit. An attacker with network access to an internet-facing BeyondTrust endpoint could send a single crafted WebSocket message and achieve full RCE on the appliance — rated at the maximum possible severity for this class of flaw.

Researchers at Hacktron AI identified approximately 11,000 internet-facing BeyondTrust instances via Shodan and Fofa at the time of disclosure. Roughly 8,500 were on-premises deployments that stayed potentially vulnerable until patched. The window between public disclosure and mass exploitation was measured in hours, not days.

Unit 42 at Palo Alto Networks documented the post-exploitation playbook in active incidents. Attackers deployed SimpleHelp RMM as a persistent backdoor, created new domain administrator accounts, and enumerated Active Directory using AdsiSearcher. Lateral movement followed immediately via PSExec and Impacket — the standard toolkit for moving through Active Directory once valid credentials are in hand. Arctic Wolf confirmed the full chain: initial access via BeyondTrust RCE, immediate credential harvesting from the vault, AD enumeration, lateral movement, and in several confirmed cases, ransomware deployment.

What made this so devastating was what attackers found once they were inside a compromised PRA appliance: stored passwords, SSH keys, and session tokens for the most sensitive systems in the organization. The PAM platform — the very tool deployed to secure privileged access — became a one-stop shop for every credential needed to take down the environment. This is the same dynamic we walked through in our breakdown of the 2022 Uber breach and PAM security: the vault is only as safe as its weakest entry point.

Why PAM Platforms Are the Crown Jewel

Privileged Access Management platforms are a paradox of modern security architecture. They were built to solve credential sprawl: instead of stashing root passwords in spreadsheets, hardcoding service account credentials in scripts, or emailing SSH keys between admins, you centralize privileged access in a single, auditable vault. Sound practice. But it concentrates value in a way that makes PAM the highest-priority target for serious attackers.

The economics are straightforward. Before PAM, compromising a single server got an attacker credentials for that server. After PAM, compromising the PAM platform gets an attacker credentials for every server the platform manages. One exploited vulnerability yields returns proportional to the entire privileged credential estate.

This isn't unique to BeyondTrust. Ivanti EPMM (CVE-2026-1281, actively exploited in February 2026) and earlier compromises of CyberArk, HashiCorp Vault, and similar platforms show that attackers have understood the value of PAM as a target for years. The Darktrace Annual Threat Report 2026 documents a 20% year-over-year increase in publicly disclosed vulnerabilities, even as attackers increasingly shift toward identity-led intrusions — going after the platforms that hold credentials rather than the systems those credentials protect.

The CrowdStrike 2026 Global Threat Report documents an 89% year-over-year increase in AI-enabled attacks, with average eCrime breakout time now at 29 minutes. Once an attacker has credentials from a PAM breach, they can move from initial access to domain compromise in under 30 minutes. With the fastest observed breakout time at 27 seconds, "detect and respond" becomes mathematically implausible if your detection mechanism is a human reviewing SIEM alerts.

Three Layers That Collapse Once PAM Is Compromised

To see why traditional controls fail after a PAM breach, look at each layer of the defensive stack.

Perimeter and endpoint defenses go quiet. Once an attacker holds valid privileged credentials pulled from a PAM vault, they authenticate as a legitimate user. Firewalls pass the traffic. EDR sees authorized processes running under authorized credentials. DLP observes data access that falls within the compromised account's permissions. To every boundary-based detection tool, this looks exactly like the authorized administrator doing their job. There's no anomaly to detect, because the attacker is using the real credentials of a real privileged account.

SIEM correlation can't separate legitimate from malicious privileged activity. Privileged access, by definition, means doing things normal users can't. A domain administrator running PowerShell queries across Active Directory looks like routine work, because usually it is. When 3.3 billion credentials were stolen from infostealer-infected machines in 2025 (per Flashpoint's 2026 Global Threat Intelligence Report), a meaningful fraction included session tokens and credential vault exports. Attackers who acquire privileged credentials generate the same SIEM events as legitimate administrators. Correlation rules tuned on behavioral baselines for privileged users are calibrated to reduce alert fatigue — which means they're specifically configured to ignore the behavior post-breach attackers exhibit.

Zero Trust offers conditional, not unconditional, protection. Zero Trust is a critical principle, but its guarantees hinge on the validity of the credentials satisfying the trust conditions. A framework that verifies "is this a privileged credential authorized to access this resource?" works fine when credentials are under control. When those credentials were stolen from a PAM vault 30 minutes ago, Zero Trust grants the attacker exactly the access it would grant the real administrator. The trust model has been satisfied — with stolen keys.

How Credential Mines and MineField Close the Gap

Mine2's deception approach solves what no authorization-based control can: it detects the use of credentials that should never be used, regardless of how valid they appear.

Credential Mines are fake privileged credentials — usernames, passwords, API keys, service account tokens — that look identical to real credentials but are never touched by legitimate systems or users. You seed them throughout the environments attackers target after a PAM breach: Active Directory, configuration files, developer workstations, cloud environment variables, and the PAM platforms themselves. When an attacker harvests credentials from a BeyondTrust vault, they can't tell Credential Mines from real ones. The moment they try to authenticate with a mine, detection is immediate, unambiguous, and free of false positives. No legitimate user ever touches a Credential Mine, because no legitimate workflow involves those credentials.

AD Mines extend this into Active Directory. After a PAM breach, AD enumeration is the attacker's first move — they need the domain topology to pick high-value targets for lateral movement. AD Mines are fake accounts and objects that surface in directory queries but serve no real purpose. When attackers run AdsiSearcher enumeration (documented in the BeyondTrust chain), they interact with AD Mines, and the moment they do, the security team knows an unauthorized entity is doing post-breach reconnaissance — before any lateral movement begins. This is the same tripwire logic we cover in our deep dive on stopping ransomware lateral movement with deception.

MineField deploys decoy TCP services across the internal network that mirror the ports and protocols of real systems. After credential theft, attackers map the network to find targets. MineField catches port scanning and connection attempts to decoy services with zero false positives. An attacker who's extracted vault credentials and is now hunting for where they apply will hit MineField before reaching a real target.

Cloud Mines handle the cloud-specific blast radius. Modern PAM platforms manage credentials for cloud infrastructure — AWS IAM roles, Azure service principals, GCP service accounts. Cloud Mines are fake AWS resources (S3 buckets, EC2 instances, Lambda functions, IAM roles) instrumented for detection. When an attacker uses stolen cloud credentials to enumerate or access cloud resources, Cloud Mines fire before real infrastructure is reached.

The distinction that matters here is signal quality. Every interaction with a mine is an unambiguous indicator of compromise. No thresholds to tune, no baselines to calibrate, no false positive rates to manage. Mines alert only when someone touches something they should never touch — and after a PAM breach, the first credential an attacker tries is exactly the detection opportunity that counts. Service-account abuse follows the same script, which is why we recommend pairing this with the controls in our piece on service account lateral movement.

The Compliance Clock Starts the Moment PAM Falls

Organizations that experienced BeyondTrust exploitation in February and March 2026 face not just operational fallout but a cascade of mandatory regulatory reporting. For security teams managing the aftermath, the requirements are non-negotiable.

GDPR (Articles 33 and 34) require notification to supervisory authorities within 72 hours of becoming aware of a personal data breach, and direct notification to affected individuals when the breach is likely to result in high risk to their rights and freedoms. A PAM breach exposing credentials that reach systems holding EU personal data triggers this — and the 72-hour clock starts the moment the organization "becomes aware," not when forensics wrap up.

India's Digital Personal Data Protection (DPDP) Act mandates that data fiduciaries report breaches to the Data Protection Board of India and notify affected data principals. With BeyondTrust deployed across major Indian financial and technology organizations, PAM breaches in Indian environments trigger DPDP obligations alongside the operational response.

CERT-In's 6-hour reporting requirement — one of the strictest breach notification mandates anywhere — requires organizations to report cybersecurity incidents to India's Computer Emergency Response Team within 6 hours of detection. For credential-theft breaches, that 6-hour window starts at detection, not containment. Organizations relying on human review of SIEM alerts routinely miss it.

PCI-DSS Requirement 11 mandates regular testing of security systems and processes, including penetration testing and detection of unauthorized access. For PCI-DSS-scoped organizations, a PAM breach exposing credentials to cardholder data environments triggers a full chain of incident response, forensic investigation, and notification under PCI-DSS Requirement 12.10.

RBI and SEBI directives for Indian financial institutions require immediate reporting of cyber incidents to the respective regulators, with SEBI's 2024 cybersecurity framework mandating incident response plans that include detection, containment, and notification timelines. PAM breaches at regulated financial institutions in India generate simultaneous obligations to SEBI, RBI (for banks and NBFCs), and CERT-In.

HIPAA's Breach Notification Rule requires covered entities and business associates to notify affected individuals within 60 days of discovery of a breach of unsecured protected health information. For healthcare organizations using BeyondTrust to manage privileged access to EHR systems, a PAM breach exposing credentials that reach PHI triggers HIPAA notification even with no evidence of PHI exfiltration — the exposure itself is reportable under HIPAA's definition.

Mine2's deception technology gives compliance teams something they rarely have after a PAM breach: a documented moment of detection that anchors the notification timeline. The audit trail — timestamp of mine interaction, source IP, credential used — is the precise detection record GDPR, CERT-In, and HIPAA frameworks demand.

A Practical Playbook for Defending PAM with Deception

For teams sizing up their exposure to PAM-targeting attacks in 2026, here's where I'd start.

Audit your PAM platform's external exposure. CVE-2026-1731 was exploitable precisely because BeyondTrust Remote Support endpoints were internet-facing. 11,000 instances were discoverable via Shodan. Run an external exposure assessment to find any PAM components reachable without VPN or jump host, and restrict public-facing management interfaces immediately.

Seed Credential Mines throughout your privileged environment. Attackers harvesting a PAM vault will exfiltrate every credential they find. Seed Credential Mines alongside the real ones — in AD, in configuration repositories, in the vault itself — so any authentication attempt against a mine generates an instant detection. Mirror the format of real credentials: same naming conventions, same service account prefixes, plausible descriptions.

Deploy AD Mines to catch post-breach enumeration. The BeyondTrust chain consistently included AD enumeration right after initial access. Place AD Mines in directories queried by standard enumeration tools (AdsiSearcher, BloodHound, PowerView) so they fire during reconnaissance, before lateral movement begins.

Instrument MineField on high-value segments. Put MineField decoy services on segments that hold privileged infrastructure: domain controller subnets, PAM appliance networks, backup server segments. Attackers moving laterally after a harvest will scan these. MineField catches the scan and the connection attempt and fires the alert that kicks off incident response.

Build 72-hour documentation into your process. GDPR's 72-hour window begins at awareness. Organizations that can't produce a documented timeline of detection, scope assessment, and notification decision face regulatory exposure on top of operational damage. Mine2's logs provide the unambiguous timestamp of compromise that anchors the clock — replacing a forensics team's best guess with a precise, auditable record.

What BeyondTrust Taught the Industry

CVE-2026-1731 is not a BeyondTrust failure in isolation. It demonstrates a structural vulnerability in how enterprise security concentrates privileged credential value. Every PAM platform that aggregates credentials for sensitive systems creates a target that, if compromised, hands attackers the keys to the kingdom. The bigger and more comprehensive the deployment — the more systems it manages, the more credentials it stores — the more catastrophic the blast radius when the platform itself is exploited.

The industry spent a decade building better credential vaults. The BeyondTrust exploitation shows the problem isn't vault security alone — it's detection capability after vault compromise. When 75% of Fortune 100 organizations run the same PAM platform and that platform has a CVSS 9.9 pre-auth RCE, the question isn't whether some of them will be breached. It's whether they can detect the breach before attackers finish their objectives.

Credential Mines answer that with a capability no vault hardening, perimeter defense, or behavioral analytics can match: the moment an attacker uses a credential they should never have touched, Mine2 knows.

The vault was compromised. The credentials were stolen. But the attacker couldn't tell the mines from the real credentials — and that difference is everything.

---

Ready to deploy Credential Mines, AD Mines, and MineField across your privileged environment? Mine2's single-click deployment puts deception across your entire attack surface in minutes — zero false positives, zero performance impact. Explore the Mine2 platform →