BeyondTrust Zero-Day Patched After Attacks Dating to August

BeyondTrust has patched a critical authentication bypass vulnerability that attackers have exploited since late August. The BeyondTrust zero-day affects Remote Support appliances and has enabled intrusions involving credential exposure, custom malware and movement into connected systems.

Tracked as CVE-2026-102764, the flaw affects Remote Support version 26.2.3 and earlier. It allows remote attackers without elevated privileges to perform file operations on vulnerable appliances.

BeyondTrust secured its Remote Support and Privileged Remote Access SaaS customers on October 8. However, customers with self-hosted installations must apply the patch manually unless automatic updates are enabled.

Researchers Link Attacks to Suspected Espionage Group

Mandiant and Google Threat Intelligence Group attributed the activity to Armory Castle, a suspected China-linked espionage actor previously tracked as UNC5221. CrowdStrike tracks the actor as Warp Panda.

According to Mandiant, the attackers first exploited the vulnerability to access exposed appliances. They then enabled Set User ID permissions to escalate from the web service account to root privileges.

That elevated access gave them control over the appliance and access to credentials it stored or handled. Furthermore, they could modify files capable of surviving reboots and configuration resets.

The distinction matters because installing a security patch does not establish whether an attacker already compromised an appliance.

Attackers Deployed Webshell and Tunneling Malware

After gaining access, the attackers deployed a new webshell called Sawfly and a tunneling tool named Bareclaw.

They also deleted logs to conceal their activity. Subsequently, they used compromised Administrator credentials to open remote sessions on other systems within victims’ networks.

The attack therefore extended beyond the initial Remote Support appliance. Its position within enterprise support infrastructure provided a route toward additional systems and sensitive credentials.

Mandiant advised organizations to treat vulnerable appliances exposed to the internet during the exploitation period as potentially compromised until investigators review them.

More Than 1,400 Instances Are Visible Online

Shadowserver tracks more than 1,400 internet-exposed BeyondTrust Remote Support and Privileged Remote Access instances.

However, that figure does not represent a confirmed count of vulnerable or compromised systems. The available data does not show how many administrators have patched their appliances or how many instances are honeypots.

Nevertheless, the exposure highlights the importance of checking affected installations promptly.

For self-hosted customers, the immediate requirement is to confirm that the relevant security update has actually installed.

Previous Campaigns Suggest Exploitation Could Expand

Armory Castle has previously targeted vulnerabilities in Citrix NetScaler and Ivanti Connect Secure appliances to breach enterprise networks.

According to Mandiant, the group has sometimes shifted from selective zero-day attacks to broader exploitation after public disclosure. Consequently, researchers warned that a similar expansion could follow publication of the BeyondTrust zero-day.

That warning describes a potential development rather than confirmed widespread exploitation of this vulnerability.

The incident also follows earlier attacks against BeyondTrust products, including exploitation of the separate CVE-2026-1731 vulnerability in ransomware activity. Those incidents involved different flaws and should not be confused with the current campaign.

For affected organizations, the response involves both closing the vulnerability and investigating possible earlier access. Root-level control, exposed credentials and persistent file changes mean a patch alone cannot resolve every consequence of an intrusion.