Record · corpus.blog/posts/01a0d4a4-941a-7270-8f8a-127182d07247

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

Unit 42 · published 19 February 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 28
Words captured: 3,164

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.beyondtrust.com/trust-center/security-advisories/bt26-02

beyondtrust.com

https://nvd.nist.gov/vuln/detail/CVE-2026-1731

nvd.nist.gov

https://docs-cortex.paloaltonetworks.com/p/XPANSE

docs-cortex.paloaltonetworks.com

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering

docs.paloaltonetworks.com

https://docs.paloaltonetworks.com/dns-security

docs.paloaltonetworks.com

https://www.paloaltonetworks.com/cortex/cortex-xdr

paloaltonetworks.com

https://www.paloaltonetworks.com/resources/datasheets/cortex-xsiam-aag

paloaltonetworks.com

https://start.paloaltonetworks.com/contact-unit42.html

start.paloaltonetworks.com

https://cwe.mitre.org/data/definitions/78.html

cwe.mitre.org

https://www.gnu.org/software/bash/manual/html_node/Arithmetic-Expansion.html

gnu.org

https://simple-help.com/

simple-help.com

https://anydesk.com/en

anydesk.com

https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/

developers.cloudflare.com

https://unit42.paloaltonetworks.com/tag/china-chopper/

unit42.paloaltonetworks.com

Actors Still Exploiting SharePoint Vulnerability to Attack Middle East Government Organizations Read at the source ↗

unit42.paloaltonetworks.com

https://github.com/XZB-1248/Spark

github.com

https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/

sentinelone.com

https://malpedia.caad.fkie.fraunhofer.de/details/win.spark_rat

malpedia.caad.fkie.fraunhofer.de

https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/

trellix.com

https://blog.nviso.eu/wp-content/uploads/2025/11/VShell.pdf

blog.nviso.eu

https://nvd.nist.gov/vuln/detail/cve-2024-12356

nvd.nist.gov

https://www.beyondtrust.com/remote-support-saas-service-security-investigation

beyondtrust.com

https://www.beyondtrust.com/trust-center/security-advisories/bt24-10

beyondtrust.com

https://www.justice.gov/opa/pr/justice-department-charges-12-chinese-contract-hackers-and-law-enforcement-officers-global

justice.gov

https://www.cyberthreatalliance.org/

cyberthreatalliance.org

https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management

paloaltonetworks.com

https://docs-cortex.paloaltonetworks.com/r/Cortex-CLOUD/Cortex-Cloud-Runtime-Security-Documentation/Endpoint-protection

docs-cortex.paloaltonetworks.com

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Premium-Documentation/Use-cases

docs-cortex.paloaltonetworks.com