A suspected China-nexus espionage actor exploited a zero-day vulnerability in BeyondTrust Remote Support since late August, according to a report from Google Threat Intelligence Group (GTIG). The attacker deployed custom backdoors, harvested credentials and stole sensitive information using the support tool’s administrative access.
BeyondTrust Remote Support vulnerability and patch
The critical flaw, tracked as CVE-2026-102764, stems from internal components of Remote Support being unable to confirm the origin of a message; under certain circumstances an attacker can then perform file operations on an affected appliance. BeyondTrust issued a patch on Oct. 9 that was automatically applied to software-as-a-service customers. Self-hosted customers who have not enrolled in automatic upgrades must perform a manual upgrade immediately, BeyondTrust said.
The Cybersecurity and Infrastructure Security Agency added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog and urged customers to patch immediately in an advisory released late Friday. Federal Civilian Executive Branch agencies have a deadline of Monday to mitigate their systems. CISA noted the patch applies to BeyondTrust Remote Support version 26.2.3 but that the upgrade only works for supported versions 24.3.1 and later; self-hosted customers on older versions must first upgrade to a supported release before applying the patch. BeyondTrust also published guidance on securing connections.
Discovery and scope
Mandiant, the incident response arm of GTIG, discovered the activity in late September while investigating a zero-day targeting edge devices on another vendor’s products and alerted BeyondTrust. BeyondTrust subsequently found an affected SaaS instance, and the exploitation activity was traced to late August. “We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure,” Kelli Vanderlee, senior analyst at GTIG, said.
Actor, malware and attack behavior
GTIG tracked the hacker as Armory Castle; the group has previously been tracked as UNC5221 and is tracked by another vendor as Warp Panda. BeyondTrust said the actor is a known espionage operator that has targeted legal services, government, technology companies, SaaS vendors and business process outsourcers.
Mandiant reported the attacker gained root access to the host, accessed all credentials stored on the appliance and targeted the secrets management database to harvest credentials. The actor deployed previously unseen custom tools, including a PHP web shell called Sawfly that enabled encrypted command-and-control communication and a SOCKS5 proxy tunneler named Bareclaw. The attacker moved laterally to gain administrative privileges and used the native BeyondTrust file transfer service to download sensitive information for reconnaissance. BeyondTrust warned that the actor has deleted forensic evidence in prior attacks.
Mitigation and recommendations
BeyondTrust advised customers to limit administrative interfaces to trusted networks and to forward appliance system logs and session events to a security information and event management (SIEM) platform. CISA and BeyondTrust both urged immediate patching and following the vendor’s detailed guidance for securing Remote Support instances.
