On self-hosted Remote Support, apply BT26-05-RS (upgrade to 24.3.1+ first if you're older), and patch self-hosted Privileged Remote Access too, since it shares the code. In the /appliance interface under Updates, enable "Automatically install critical updates during the Maintenance Window". Restrict the admin interface to trusted networks, limit appliance egress to required destinations, and forward syslog and session events to your SIEM in near real time, because this actor deletes local logs. If you find signs of compromise, image the appliance before rebuilding, rotate every credential it stored or injected, and review new MFA registrations on privileged accounts.