17 OCT 2026 — A suspected Chinese state-linked espionage group exploited a previously unknown flaw in BeyondTrust's Remote Support appliances starting in late August, weeks before a patch was available, according to Google's Mandiant. BeyondTrust disclosed the vulnerability, CVE-2026-102764, on 15 October and urged self-hosted customers to patch immediately. Mandiant says any appliance that was exposed to the internet while running a vulnerable version should be treated as potentially compromised.
Remote Support is the tool IT help desks use to take control of employees' and customers' machines. That makes it a high-value foothold. Whoever controls the appliance controls the credentials it holds for everything it can reach.
What the flaw does
The vulnerability is an authentication bypass that lets an unprivileged remote attacker upload files to an unpatched appliance. BleepingComputer reports that it affects Remote Support 26.2.3 and earlier. BeyondTrust patched its cloud-hosted Remote Support and Privileged Remote Access customers on 8 October. Self-hosted installations need to be updated manually unless automatic updates are on.
BeyondTrust also released the fix for Privileged Remote Access, its tool for managing administrator sessions, even though its own testing found no way to exploit the bug there. The company said the product "shares the affected code", so customers should apply the patch anyway.
What the attackers did
Mandiant's analysis, based on an incident response engagement, attributes the attacks to a group it calls Armory Castle, previously tracked as UNC5221. CrowdStrike calls the same group Warp Panda. After exploiting the flaw, the attackers planted a small web shell Mandiant named Sawfly, then created a permanent root backdoor by copying the system shell to a new file and setting it to run with root privileges.
From there they tried to dump the appliance's credential vault using BeyondTrust's own administrative tool, deployed a tunnelling program called Bareclaw and deleted logs to cover their tracks. "This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant wrote. BleepingComputer reports that the group then moved into victims' networks using stolen administrator credentials.
A group with a pattern
Armory Castle, under its earlier name, is the group behind the mass exploitation of Ivanti VPN appliances in early 2024, when more than 2,100 devices were backdoored, according to security firm Volexity. Mandiant warns that this group and others have "historically conducted broad, opportunistic exploitation once the vulnerability becomes public". In practice, a flaw used quietly against chosen targets is often sprayed across the internet once it is disclosed.
Not the first time
BeyondTrust has dealt with this before. Chinese state hackers are believed to have used two earlier zero-days in 2024 to break into BeyondTrust's systems and reach the US Treasury's Remote Support instance. Another flaw, CVE-2026-1731, was exploited this year in ransomware attacks, according to BleepingComputer. The US Cybersecurity and Infrastructure Security Agency added the new flaw to its exploited vulnerabilities catalogue on 16 October with a three-day deadline. It is the latest in a run of edge-device zero-days RECATOOLS has tracked this month, after Palo Alto's PAN-OS and Ivanti Connect Secure.
What to do
Patching closes the hole but does not undo a compromise. Self-hosted Remote Support and Privileged Remote Access customers should apply the update now. Anyone whose appliance faced the internet on a vulnerable version since late August should follow Mandiant's advice and investigate it. Because the attackers targeted the credential vault, check the appliance for the files and accounts Mandiant describes, and rotate every credential it stored, not only the appliance's own passwords.
View author profile → · Editorial policy
