Suspected Chinese Hackers Exploited BeyondTrust Remote Support Flaw as a Zero-Day Since Aug. 29, Google and BeyondTrust Say

A critical flaw in BeyondTrust's Remote Support software was exploited as a zero-day for about seven weeks before anyone outside the company heard about it. BeyondTrust, Mandiant and Google Threat Intelligence Group went public Thursday, Oct. 15, and pinned the attacks on a suspected Chinese state-backed espionage group.

The group is tracked as Armory Castle. Mandiant formerly called it UNC5221, and CrowdStrike calls it Warp Panda.

What the flaw does

The bug is tracked as CVE-2026-102764 and carries a CVSS score of 9.3. BeyondTrust describes it as a failure to properly validate the origin of messages in an internal component of Remote Support, which "could be used to perform file operations on the appliance." Google describes the result as arbitrary file upload.

BeyondTrust is withholding technical details. The company said publishing them while self-hosted appliances are still being patched would put customers at greater risk.

Remote Support versions through 26.2.3 are affected. Self-hosted customers on 24.3.1 through 26.2.3 need the BT26-05-RS patch. Anyone on a version older than 24.3.1 has to upgrade first.

BeyondTrust's Privileged Remote Access product shares the vulnerable code. The company said internal testing found no way to exploit it there, but it released the patch anyway and told self-hosted PRA customers to apply it.

The timeline

BeyondTrust's own account runs like this:

• Aug. 29: The actor exploited the zero-day against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance.
• Sept. 27: Successful exploitation of another vendor's security device became public. BeyondTrust started hunting for similar activity.
• Sept. 28: Threat hunting turned up the hosted-instance intrusion. The company says it contained that instance within 27 minutes of first detection, and by evening its product security team had reproduced the attack.
• Sept. 30: Mandiant shared findings from the self-hosted victim that matched BeyondTrust's own.
• Oct. 8: BeyondTrust shipped the BT26-05 patch. SaaS instances were patched automatically. Self-hosted customers had to do it themselves.
• Oct. 15: Coordinated public disclosure of the CVE, the advisory and Mandiant's analysis.

That leaves a week between the patch and the public disclosure, and roughly seven weeks between first exploitation and disclosure.

How the attackers operated

Mandiant says the group did not stop at the initial break-in. After exploiting the bug, the attackers dropped a lightweight, obfuscated PHP web shell called SAWFLY, which gives them interactive access and encrypted two-way command-and-control. They also used a tunneling tool Mandiant calls BARECLAW.

They then copied the system shell to /usr/bin/dbus-authd, made root the owner and turned on SUID permissions. Mandiant says that gave them a persistent root-level backdoor on the appliance.

From there, the attackers reached every credential the appliance stored or brokered. They also tried to pull secrets from the appliance's native database using BeyondTrust's own administrative utility. Mandiant says they could modify files that survive reboots and configuration resets.

The group deleted appliance logs and endpoint artifacts, and used compromised administrator credentials to open remote sessions on downstream systems. It routed traffic through commercial VPN exit nodes and compromised home and small-office routers.

Mandiant's guidance is blunt: any vulnerable appliance that was reachable from the internet during the exploitation window should be treated as potentially compromised until reviewed.

A familiar playbook

Google and BeyondTrust say Armory Castle has been active since October 2023. It has previously exploited zero-days in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282).

Its documented targets include legal services firms, SaaS providers, business-process outsourcers, technology companies and governments. BeyondTrust says the group is focused on long-term intelligence collection, and that researchers believe it hits technology vendors partly to find more zero-days.

BeyondTrust says the actor uses a zero-day selectively against chosen targets, then moves to broad exploitation of every unpatched instance once the flaw is public. Google said the same about past campaigns and warned that "it is possible that we will observe similar widespread exploitation attempts" tied to this CVE.

BeyondTrust offered an assessment of how the group picks targets: it "selects high-value software targets in advance and keeps a working model of the products the actor targets in an AI context that it uses on an ongoing basis to develop exploit chains." That is the company's working assessment, not an established finding. Google separately said it assesses with high confidence that Armory Castle will keep using edge-device zero-days.

What is exposed now

The internet watchdog Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed online. It does not say how many are already patched or how many are honeypots.

Remote support appliances sit at the edge of corporate networks and hold the keys to the systems behind them. That is why a group that wants long-term access keeps going after them.

BeyondTrust has confirmed two affected instances, one it hosts and one self-hosted. It has not said how many other customers were hit. With the flaw now public and the clock running on self-hosted patching, it is unclear how many unpatched appliances Armory Castle or copycat attackers will reach before administrators finish updating.