Google has warned that a flaw in BeyondTrust remote support software could be widely exploited, urging organisations to prepare.
Google's Threat Intelligence Group and Mandiant said a suspected China-linked group, tracked as "Armory Castle," had already exploited the same flaw as a zero-day in August.
A successful attack could give an attacker access to credentials, allow file uploads and hand over control of the host system.
The warning underlines the importance of security updates and access controls for businesses that rely on remote support tools.