A BeyondTrust Remote Support zero-day was exploited from late August by Armory Castle, a group Mandiant, Google Threat Intelligence Group and BeyondTrust assess as a China-linked espionage operation. The flaw gave attackers a route into an IT support appliance built to let administrators reach and troubleshoot remote systems, which is exactly the sort of privileged perch attackers like.
BeyondTrust has released a fix for CVE-2026-102764. Its cloud service received the update automatically, according to Cybersecurity Dive, while self-hosted customers need to confirm their appliances have been upgraded. Organizations that exposed vulnerable appliances to the internet should also investigate for intrusion activity before the patch, not assume an update removes an attacker already inside.
What does the BeyondTrust Remote Support zero-day allow?
CVE-2026-102764 affects internal Remote Support components that, under certain conditions, did not verify where a message came from, Cybersecurity Dive reported. That could permit file operations on an affected appliance.
Mandiant said the intruders used the vulnerability to raise their privileges, move through victims' networks and establish more durable access. Researchers reported that the operators reached credentials stored on the appliance and altered files that could survive both reboots and configuration resets. In other words, applying a patch closes the known entry point, but does not by itself establish that a system was not compromised earlier.
The group used custom tools called Sawfly and Bareclaw, according to Mandiant. Sawfly was a PHP web shell used for encrypted command-and-control communication, while Bareclaw functioned as a SOCKS5 proxy tunneler, Cybersecurity Dive reported. Mandiant said the activity reflected detailed knowledge of the appliance's internal workings.
What BeyondTrust customers should check
- Install BeyondTrust's update and verify that self-hosted Remote Support systems are actually running the fixed version.
- Review internet-reachable appliances for evidence of pre-disclosure exploitation, especially unexpected file changes, credentials accessed from the appliance, persistence mechanisms and unusual network connections.
- Consider a vulnerable, internet-facing appliance potentially compromised until it has been reviewed, as Mandiant advised.
The supplied reporting differs by one day on the patch's release, with CyberScoop placing the self-hosted release and automatic cloud update on Oct. 8 and Cybersecurity Dive reporting an Oct. 9 patch. Both accounts agree that BeyondTrust made a fix available and automatically updated its cloud offering.
BeyondTrust said the first known exploitation occurred Aug. 29. CyberScoop reported the company detected and contained malicious activity on Sept. 28, after it began investigating following reports of zero-day activity against another vendor's edge devices. Google said it knew of only a small number of affected organizations, but warned that the stealth of the campaign meant other pre-disclosure compromises were possible.
Armory Castle was previously known as UNC5221. BeyondTrust and Mandiant describe it as a Chinese state-sponsored intelligence operation with reported targets including government agencies, legal services, technology companies, software-as-a-service providers and business-process outsourcers. The researchers warn that the group has previously used flaws selectively before public disclosure, then pursued broader exploitation of systems left unpatched. That is a risk forecast for this flaw, not confirmation that widespread exploitation has occurred.
Google researchers also said there was not enough evidence to identify a broader targeting trend or connect this campaign to contemporaneous Citrix NetScaler attacks. The useful part is less glamorous: patch the appliance, then check whether someone used it before the patch arrived.
This story draws on original reporting from The Record.
