BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group. “Organizations should prepare for potential widespread exploitation following this disclosure,” Google Threat Intelligence Group (GTIG) and Mandiant said in a blog post. The post attributes the zero-day exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, and dates it to late August. BeyondTrust disclosed the flaw, CVE-2026-102764, the same day in advisory BT26-05 and said it had already released a patch on Oct. 8. According to the CVE record, it scores 9.3 on CVSS 4.0 and affects Remote Support versions up to 26.2.3. Mandiant said an unauthenticated attacker can exploit it to perform file operations, leading to host-level control and access to every credential the appliance stores or brokers. BeyondTrust urged self-hosted customers to apply the patch immediately and said in a blog post that it is withholding technical details while they do. A month undetected BeyondTrust’s timeline puts the first exploitation on Aug. 29, against one BeyondTrust-hosted instance and one self-hosted appliance. The company found the intrusion on Sept. 28, after another vendor’s edge appliances were publicly reported as compromised and Mandiant sent a brief, non-specific warning. “Our sensors fired in real time when the actor escalated privileges,” BeyondTrust wrote in the blog. The built-in triage tool in its third-party detection platform then closed those alerts as false positives, the company said, without naming the vendor. BeyondTrust said it contained the hosted instance 27 minutes after identifying it and is working with the vendor, so automated triage cannot close high-severity signals on its own. Neither company has said whether other customers were compromised. Root, persistence, and log wiping About 11 minutes after the first malicious request, a PHP web shell Mandiant calls SAWFLY appeared in the appliance’s web root, Google said in the blog post. To escalate from SAWFLY’s unprivileged service account, the actor copied /bin/sh to /usr/bin/dbus-authd, made root its owner, and set the SUID bit, Mandiant said. It then planted a startup script that writes a passwordless sudo entry into BeyondTrust’s sudoers template, so the access survives reboots and configuration resets. According to the blog post, the actor also tried several variations of bt-secrets, a proprietary BeyondTrust command-line utility, to dump the appliance’s credential vault. It later deleted more than a dozen system, web server, and application logs. Turning the help desk tool against its owner In the blog post Mandiant added that the attacker raised the account’s Jump Item and Team permissions from No Access to Administrator using a compromised administrator account. “This configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance’s Jump Item list,” the blog post added. It also deployed BARECLAW, a custom SOCKS5 tunneler, and edited the appliance’s HAProxy configuration to route traffic to it through a hidden local listener, the post noted. SaaS customers are not off the hook BeyondTrust said SaaS instances of Remote Support and Privileged Remote Access were patched automatically and that those customers need take no further action. Mandiant’s report dates the SaaS rollout to Oct. 9 and says its credential rotation and configuration review steps still apply to SaaS customers. Self-hosted appliances on version 24.3.1 or later can apply the BT26-05-RS patch from the /appliance interface, Mandiant said. Older versions must first be upgraded, and upgrading does not remediate prior exposure. BeyondTrust also patched Privileged Remote Access, which shares the affected code, though it found no way to exploit PRA. “Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed,” Mandiant said in the post. Because customers cannot audit the appliance’s host file system, Mandiant recommends snapshotting suspect appliances before any reboot and rebuilding compromised ones from a clean image. It advises rotating credentials only after patching, so new secrets do not land on a box the attacker still controls. Same group, same playbook GTIG said ARMORY CASTLE has been active since at least October 2023 and assessed with high confidence that it will keep exploiting edge device zero-days. BeyondTrust said CrowdStrike tracks the same cluster as WARP PANDA. “It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764,” Mandiant said in the post. GTIG compared the risk to 2024, when the group moved to mass exploitation after Ivanti Connect Secure flaws were disclosed. In 2025, it turned an Ivanti patch into a working exploit. BeyondTrust said it suspects, without forensic proof, that the actor uses AI to model the products it targets, echoing a GTIG finding that attackers are weaponizing newly disclosed flaws faster. BT26-05 is BeyondTrust’s third critical-rated Remote Support advisory this year, according to its advisory index. In February, CVE-2026-1731 came under active attack shortly after disclosure, and CISA added it to its Known Exploited Vulnerabilities catalog.