How a remote support tool became a gateway for state-sponsored hackers
In short: In 2024, the U.S. Treasury Department faced a major security breach involving state-sponsored Chinese hackers. The attackers didn't break in through a front door; they stole an API key from a remote support application provided by BeyondTrust to infiltrate workstations and view unclassified documents.
BeyondTrust is the modern iteration of a complex corporate lineage involving several major acquisitions and rebranding efforts. The company’s roots trace back to 1985 as Symark, a VAX/VMS utility software firm in Los Angeles founded by Bob Sommers and Doug Yarrow. Over decades, it evolved into a provider of privileged access management (PAM) and vulnerability management software, expanding globally into markets like Japan and Latin America between 2003 and 2008. The original firm was a client-server computing vendor before securing a license for UPM. They eventually rebranded their version of this security product as PowerBroker. The company moved its headquarters from San Fernando Valley to Westlake Village and later to Agoura Hills.
The company's identity has shifted significantly through mergers. BeyondTrust was purchased by Veritas Capital, a private equity company, for $310 million during 2014. Meanwhile, a separate lineage involved Bomgar Corporation, which originated in June 2003 when Joel Bomgaars launched ExpertVNC to solve his own travel inefficiencies as a support professional. After several name changes—including NetworkStreaming and finally Bomgar in 2007—Bomgar acquired BeyondTrust in 2018. The company eventually consolidated its identity under the BeyondTrust name. In May 2014, TA Associates became the first private equity investors to hold a majority stake in Bomgar. Francisco Partners announced an acquisition of the firm in April 2018 from Thoma Bravo. The company's history includes several previous names like NetworkStreaming and ExpertVNC.
The security implications of these tools are profound. While companies like BeyondTrust provide essential remote support capabilities, they also create high-value targets for cyber espionage. In a reported incident on December 30, 2024, Chinese state-sponsored hackers exploited a remote support SaaS application's API key from BeyondTrust. This allowed them to compromise U.S. Treasury workstations, highlighting the risks inherent in third-party remote access software where a single stolen credential can grant entry into sensitive government infrastructure. The stolen API key was specifically for a remote support SaaS application. This breach allowed the intruders to view unclassified documents during the major incident. These tools are used by professionals to manage devices ranging from smartphones to point-of-sale systems.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: BeyondTrust
To cite this card, link to https://intellectplus.co.uk/app/society-beyondtrust.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Communication · More in Society · Latest · A–Z · All topics
