BeyondTrust Remote Support zero-day exploited since August

BeyondTrust is urging customers to patch a critical authentication bypass flaw in its Remote Support (RS) product. A suspected China-nexus espionage group has been exploiting the flaw as a zero-day since late August.

The vulnerability is tracked as CVE-2026-102764. It allows unprivileged remote attackers to perform file operations on unpatched appliances and affects RS 26.2.3 and earlier. The company issued the warning on Thursday.

Remote Support is BeyondTrust's enterprise tool for IT service desks, help desks and customer support teams, who use it to troubleshoot problems on remote machines.

SaaS fixed, self-hosted needs action

BeyondTrust fixed the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8. Organizations running self-hosted installations must apply the patch manually if they have not enabled automatic updates.

The company released few technical details about the flaw. It did say who is behind the attacks. Mandiant and Google Threat Intelligence Group (GTIG) track the attackers as "Armory Castle," formerly known as UNC5221. CrowdStrike calls the same actor "Warp Panda."

From web shell to root

Mandiant researchers spotted the first attacks. According to their findings, Armory Castle used the flaw for initial access. The attackers then gained root privileges on the compromised devices by enabling Set User ID (SUID) permissions.

With that level of control, the attackers deployed two previously unseen malware tools: the Sawfly web shell and the Bareclaw tunneler. They wiped logs to avoid detection. They then used compromised Administrator credentials to open remote sessions on downstream systems and move laterally through the victim's network.

"After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant said.

Mandiant's advice is direct: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed."

Shadowserver, a non-profit that monitors internet threats, tracks more than 1,400 BeyondTrust remote support instances exposed online. It does not say how many of them have already been patched or how many are honeypots.

A familiar actor at the network edge

Armory Castle has a track record. Since at least October 2023, the group has gone after zero-days in network edge appliances to break into enterprise networks and install custom malware. Its past targets include Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, and later CVE-2025-0282).

In January 2024, Volexity reported that UNC5221 had backdoored more than 2,100 Ivanti appliances with the GiftedVisitor webshell. Those attacks chained CVE-2023-46805 and CVE-2024-21887.

Mandiant warned that the pattern could repeat. "In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed," the company said. "It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764."

BeyondTrust's run of exploited flaws

This is not the first BeyondTrust bug to be exploited in the wild in recent years. Most recently, attackers used a critical remote code execution flaw, CVE-2026-1731, in Remote Support and Privileged Remote Access appliances to set up WebSocket channels and deploy ransomware.

Earlier, the Chinese state-backed Silk Typhoon group is believed to have exploited two zero-days, CVE-2024-12356 and CVE-2024-12686, to breach BeyondTrust's own systems. Using a stolen API key, the group compromised 17 Remote Support SaaS instances, including one belonging to the U.S. Treasury Department.

The same campaign also targeted the Office of Foreign Assets Control (OFAC), which runs U.S. sanctions programs, and the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments for national security risks.

BeyondTrust says it serves more than 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies.

Our Take

Remote support tools are attractive targets because they are built to hold credentials and reach deep into networks. This case shows exactly that risk. Once Armory Castle had root on the appliance, Mandiant says it had access to every credential the box stored or brokered. That suggests a patch alone is not enough for anyone who ran a vulnerable, internet-facing version since late August. A compromise review, credential rotation and log checks on downstream systems look like the more prudent response.

The incident also fits a broader trend of state-linked groups going after edge devices. Recent weeks have brought exploited bugs in Ivanti Connect Secure, Palo Alto Networks PAN-OS and Cisco's email gateway.

Two things are worth watching next. The first is whether Mandiant's warning of wider opportunistic exploitation comes true now that the flaw is public. The second is how quickly the 1,400 or so exposed instances counted by Shadowserver shrink.