China-Linked Group Exploited BeyondTrust Remote Support Zero-Day
Summary
BeyondTrust says Armory Castle exploited CVE-2026-102764 on one self-hosted Remote Support appliance in August 2026. SaaS patches were applied by October 9; affected self-hosted customers should install the designated patch or upgrade.
Key points
- CVE-2026-102764 is an origin-validation flaw in BeyondTrust Remote Support that could let a remote attacker perform file operations on an appliance; it has a CVSS score of 9.3.
- BeyondTrust says Armory Castle exploited the flaw as a zero-day on one self-hosted appliance on August 29, 2026.
- SaaS customers received patches by October 9, 2026. Self-hosted customers on versions 24.3.1 through 26.2.3 are advised to install patch BT26-05-RS; older versions must be upgraded.
- Mandiant reports that successful compromise was followed by deployment of the SAWFLY PHP web shell for remote access and encrypted command-and-control.
- The reported intrusion involved privilege escalation, persistence, access to stored secrets, credential theft, and attempts to reach downstream systems.
- BeyondTrust advises that internet-reachable appliances running a vulnerable version during the exploitation window be treated as potentially compromised until reviewed.
Article Details
- Vulnerability Types
- Improper origin validation in an internal messaging component, enabling remote file operations
- Severity
- CVSS 9.3
- Affected Versions
- BeyondTrust Remote Support: self-hosted versions 24.3.1 through 26.2.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1021 · Remote ServicesThe attackers abused administrative access to reach downstream systems and enable lateral movement.T1071 · Application Layer ProtocolSAWFLY provided bidirectional encrypted command-and-control communication.T1090 · ProxyThe operator used commercial VPN exit nodes and compromised home and small-office routers to blend into regular traffic.T1505.003 · Web ShellThe attackers deployed the SAWFLY PHP web shell for interactive remote access.T1547 · Boot or Logon Autostart ExecutionThe attackers established persistence designed to survive appliance reboots.T1552.001 · Credentials In FilesThe attackers read secrets stored on the appliance to facilitate credential theft.
CVE
People
Brian MeyerNamed GTIG and Mandiant researcher who shared details about the exploitation activity.Bryce GreathouseNamed GTIG and Mandiant researcher who shared details about the exploitation activity.Jayson FrostNamed GTIG and Mandiant researcher who shared details about the exploitation activity.John PalmisanoNamed GTIG and Mandiant researcher who shared details about the exploitation activity.John WolframNamed GTIG and Mandiant researcher who shared details about the exploitation activity.Rajesh RajeshirkeNamed GTIG and Mandiant researcher who shared details about the exploitation activity.Steve RaschNamed GTIG and Mandiant researcher who shared details about the exploitation activity.
Threat Actors
Malware
Vendors
Products
BeyondTrust Remote SupportArmory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.Citrix NetScalerArmory Castle has a history of exploiting zero-day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances to break a wide range ofIvanti Connect Securehas a history of exploiting zero-day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances to break a wide range of sectors,
Industries
Legal servicesCVE-2024-21887, and CVE-2025-0282) appliances to break a wide range of sectors, including legal services, SaaS providers, business-process outsourcers, technology, and governments, for long-termSaaSPatches for the flaw have been pushed to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update toTechnologybreak a wide range of sectors, including legal services, SaaS providers, business-process outsourcers, technology, and governments, for long-term intelligence collection. It's known to be active since October 2023.