China-Linked Hackers Exploited BeyondTrust Zero-Day to Compromise Remote Support Servers

China-linked cyber espionage activity targeting BeyondTrust Remote Support has raised serious concerns for organisations that rely on remote access technology to manage internal systems. The threat actor tracked as ARMORY CASTLE, previously known as UNC5221 and associated with the name Warp Panda, exploited a critical vulnerability before its public disclosure, according to BeyondTrust and Google Threat Intelligence Group (GTIG) and Mandiant.

Tracked as CVE-2026-102764, the vulnerability has a reported CVSS score of 9.3. It affects BeyondTrust Remote Support and involves inadequate origin validation in an internal messaging component. Under certain conditions, a remote attacker could exploit the weakness to perform unauthorised file operations on an affected appliance. <Cite refs={[“turn725497search0″,”turn725497search2”]}/>

The incident is particularly concerning because remote support appliances can provide access to other systems within an organisation. A compromise of this infrastructure may therefore expose administrative credentials, sensitive information and connected endpoints.

BeyondTrust released a security patch, while the US Cybersecurity and Infrastructure Security Agency (CISA) urged organisations to prioritise remediation. Security teams should not assume that patching alone is sufficient if a vulnerable appliance was exposed during the exploitation period.

What Is CVE-2026-102764?

CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support, identified in the vendor’s BT26-05 security advisory.

The weakness involves improper origin validation in an internal messaging component. In simple terms, the affected component did not adequately verify where incoming messages originated. Under the right conditions, this could allow an attacker to trigger file operations on the appliance.

BeyondTrust assigned the vulnerability a CVSS v4 score of 9.3, placing it in the critical severity category.

The principal security concern is not limited to the initial file operation. Remote support appliances are designed to facilitate access to managed systems, so unauthorised control of an appliance may create opportunities to access credentials, interact with administrative functions and reach connected endpoints.

Organisations should assess the vulnerability based on their deployed product versions, internet exposure, patch status and any evidence of suspicious activity.

Which BeyondTrust Products and Versions Are Affected?

BeyondTrust’s advisory identifies all Remote Support versions up to and including 26.2.3 as affected. The vendor provides the BT26-05-RS patch for Remote Support versions 24.3.1 through 26.2.3. Customers running older versions must upgrade to a supported version before applying the patch.

The response differs depending on how the product is deployed.

BeyondTrust SaaS customers

BeyondTrust stated that the security patch had been applied to Remote Support SaaS customers by October 9, 2026. Its response timeline also says applicable SaaS instances of Remote Support and Privileged Remote Access were automatically patched when the update was released.

Customers should consult BeyondTrust if they need confirmation of their instance’s status or have concerns about suspicious activity.

Self-hosted Remote Support customers

Organisations operating their own appliances must verify that the appropriate patch has been installed. Customers who are not subscribed to automatic updates may need to apply the update manually through the appliance interface.

The recommended actions are to:

• Identify all Remote Support appliances and their installed versions.
• Review the official BT26-05 advisory.
• Apply the BT26-05-RS patch to affected self-hosted deployments.
• Upgrade installations older than version 24.3.1 before applying the relevant patch.
• Confirm the resulting patch status and document the change.

Privileged Remote Access customers

BeyondTrust also released a precautionary patch for self-hosted Privileged Remote Access (PRA) because it shares affected code. The company said its testing had not identified an exploitation path for PRA, but recommended applying the patch as a precaution.

Official advisory: BeyondTrust BT26-05 — CVE-2026-102764

How ARMORY CASTLE Exploited the Zero-Day

According to BeyondTrust’s incident timeline, ARMORY CASTLE exploited the vulnerability on August 29, 2026, against a single self-hosted Remote Support appliance and a single BeyondTrust-hosted instance. The activity occurred before the vulnerability was publicly disclosed.

BeyondTrust began investigating after a separate security-device exploitation incident became public on September 27. Its threat-hunting activity identified indications of the BeyondTrust incident the following day, and the company reported containing the affected instance within 27 minutes of initial detection.

On September 30, Mandiant shared findings from its investigation of a self-hosted customer. BeyondTrust subsequently released the patch on October 8, with SaaS patching completed by October 9. The coordinated public disclosure followed on October 15.

The timeline illustrates why vulnerability response requires more than publishing an advisory. Security vendors must investigate suspicious activity, determine how a weakness was exploited, develop a fix and communicate remediation requirements to customers.

What Happened After the Initial Compromise?

Google Threat Intelligence Group and Mandiant reported that successful exploitation was followed by deployment of a lightweight PHP web shell called SAWFLY. The web shell provided interactive remote access and encrypted command-and-control communication.

The reported post-compromise activity included several significant behaviours.

Privileged access and persistence

Investigators described activity intended to obtain root-level control of the appliance and maintain access across reboots. The reported techniques included abusing system utilities and configuration mechanisms.

Such persistence is particularly concerning on remote support infrastructure because an attacker may attempt to preserve access even after the original vulnerability has been patched.

Credential theft

The attackers reportedly targeted the appliance’s secrets-management capabilities to retrieve stored passwords, API keys and endpoint credentials. They also investigated configuration templates that could provide additional privileged access.

Credential theft can turn a compromise of one appliance into a broader identity-security incident. Exposed secrets may allow attackers to access connected services or systems without repeatedly exploiting the original vulnerability.

Access to connected systems

The reported activity included using compromised administrator credentials and the appliance’s Jump Item list to initiate remote support sessions to downstream systems.

Investigators said the actor sought access to internal endpoints and sensitive documents for further reconnaissance and intelligence collection.

This is an important reminder that remote administration platforms should be treated as high-value infrastructure. They can concentrate privileged access to multiple endpoints in a single management environment.

Network tunnelling and log tampering

The investigation also described use of a custom SOCKS5 proxy tunneller called BARECLAW and changes intended to make its network access available externally. The actor also reportedly deleted system, web server and application logs to hinder detection.

These behaviours can complicate incident response by reducing the evidence available to investigators and creating additional uncertainty about the scope of a compromise.

Why ARMORY CASTLE Is a Significant Threat

BeyondTrust and Mandiant assess the activity as associated with a China-nexus espionage actor. Public reporting links the group to long-term intelligence collection targeting organisations in technology, government, legal services, software-as-a-service and business-process outsourcing.

The group has also been associated with exploitation of other remote-access and security appliances, including Citrix NetScaler and Ivanti Connect Secure products.

According to BeyondTrust, the actor has used a selective approach to zero-day exploitation: targeting chosen victims before disclosure and then potentially expanding exploitation to systems that remain unpatched after a vulnerability becomes public.

This pattern makes rapid remediation essential. Once technical details and patch information become public, defenders should anticipate that other attackers may investigate the same weakness.

Attribution should nevertheless be treated carefully. Security researchers assess threat groups using technical evidence and observed behaviour; an organisation should not infer that every intrusion involving the same product is attributable to the same actor.

CISA Urges Organisations to Patch Immediately

On October 16, 2026, CISA issued an advisory urging organisations using affected BeyondTrust Remote Support appliances to take immediate action. The agency also added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalogue. The supplied reporting identifies October 19, 2026, as the remediation deadline for Federal Civilian Executive Branch agencies. <Cite refs={[“turn725497search5″,”turn725497search2”]}/>

The agency’s recommendations go beyond installing the patch. Organisations should restrict unnecessary external access, conduct network and memory forensics when compromise is suspected, isolate affected appliances and investigate evidence of malicious activity.

Where a device is suspected or confirmed to be compromised, security teams should preserve appropriate forensic evidence and follow a recovery plan that restores the appliance from a known-good state before returning it to service.

CISA advisory: CISA urges patching critical BeyondTrust Remote Support vulnerability

Recommended Security Actions for Organisations

Organisations should treat this incident as both a vulnerability-management priority and a potential incident-response concern.

1. Patch affected appliances

Identify Remote Support versions across all environments and apply the appropriate vendor-provided patch. Do not rely on memory, deployment records alone or assumptions about automatic updates; verify the actual status of each appliance.

2. Reduce external exposure

Restrict access to remote support and administrative interfaces to the networks, services and users that genuinely require it. Review firewall rules and remove unnecessary internet-facing access.

3. Investigate suspicious activity

Review authentication records, privileged sessions, application events, web server logs and network connections for unusual behaviour. Look for unrecognised administrative access, unexpected remote sessions, unexplained configuration changes and evidence of unauthorised file operations.

Because the reported actor deleted some logs, the absence of suspicious entries should not be treated as proof that a system was never compromised.

4. Protect credentials and connected systems

If compromise is suspected, assess whether stored passwords, API keys or endpoint credentials could have been exposed. Follow incident-response procedures to revoke or rotate affected secrets and review access to connected systems.

5. Preserve forensic evidence

Collect relevant logs, snapshots and forensic images as appropriate before making changes that could destroy evidence. Coordinate with the vendor and qualified incident responders when the scope of the compromise is uncertain.

6. Rebuild compromised appliances when necessary

For confirmed compromise, applying a patch may not remove existing persistence or restore trust in the system. Follow the vendor and CISA guidance for isolation, investigation and rebuilding from a known-good state before reconnecting the appliance.

7. Monitor for related activity

Review other remote-access appliances and security devices for similar suspicious behaviour. Ensure logs are forwarded to a separate, protected logging system where feasible, so an attacker who compromises an appliance cannot easily remove all available evidence.

What This Incident Means for Remote Access Security

The BeyondTrust incident demonstrates why remote support systems require strong controls. These platforms can provide privileged access to multiple internal systems, making them attractive targets for espionage groups and other attackers.

Organisations should combine timely patching with restricted network access, strong authentication, least-privilege administration, centralised logging and tested incident-response procedures.

Security teams should also assess whether they can detect unusual administrative sessions and credential access across the systems managed by remote support tools. These controls can help limit the impact of an intrusion even when a previously unknown vulnerability is exploited.

Conclusion

The exploitation of CVE-2026-102764 highlights the risks posed by zero-day vulnerabilities in remote administration infrastructure. ARMORY CASTLE reportedly used the BeyondTrust flaw to gain access to an appliance and then pursued privileged access, credential theft, persistence and movement into connected systems.

BeyondTrust has released the BT26-05 patch, and CISA has urged organisations to prioritise remediation. Administrators should verify patch status, restrict external exposure and investigate potentially compromised appliances rather than assuming that an update alone resolves every risk.

For organisations that depend on remote support platforms, rapid patching, protected logs, credential security and disciplined incident response are essential to reducing the impact of sophisticated cyber espionage.

CyberExy — Secure Tomorrow.