cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

China-Linked APT Exploited BeyondTrust Remote Support Flaw as a Zero-Day

· Original article ↗

Summary

Mandiant and Google GTIG say China-linked Armory Castle exploited CVE-2026-102764 in BeyondTrust Remote Support from August, using webshells and a tunneler. BeyondTrust patched affected versions; SaaS customers have been updated, while some self-hosted users must patch.

Key points

  • CVE-2026-102764, rated CVSS 9.3, is an improper validation of message origins that could allow file operations on BeyondTrust Remote Support appliances.
  • BeyondTrust says versions up to and including 26.2.3 are affected. The BT26-05-RS patch covers versions 24.3.1 through 26.2.3; customers on older releases should upgrade before applying it.
  • Mandiant and Google GTIG attribute zero-day exploitation beginning August 29 to Armory Castle, also tracked as UNC5221 and Warp Panda.
  • Investigators observed the attackers deploy the Sawfly webshell and Bareclaw tunneler, gain root-level control, harvest credentials, and move laterally.
  • The attackers reportedly used compromised administrator credentials and Remote Support tools to access internal systems and exfiltrate documents useful for network reconnaissance.
  • BeyondTrust says the fix shipped October 8 and had been applied to all Remote Support SaaS customers by October 9, 2026. Self-hosted customers without automatic updates should apply it manually.

Article Details

Vulnerability Types
  • Improper validation of message origins, potentially allowing file operations on Remote Support appliances
Severity
CVSS 9.3
Affected Versions
  • BeyondTrust Remote Support versions up to and including 26.2.3
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Self-hosted customers should manually apply the fix if automatic updates are not enabled.
  • Customers on releases older than 24.3.1 should upgrade to a newer version and then apply the BT26-05-RS patch.

MITRE ATT&CK

T1070.004 · File DeletionThe attackers systematically deleted system, web server, and application-level logs.T1078 · Valid AccountsThe attackers used compromised administrator credentials to access the RS application and modify account permissions.T1090 · ProxyThe attackers used Bareclaw, a SOCKS5 proxy tunneler that can chain traffic through an upstream proxy.T1190 · Exploit Public-Facing ApplicationArmory Castle targeted a BeyondTrust Remote Support appliance for initial access by exploiting CVE-2026-102764.T1505.003 · Web ShellThe group deployed the Sawfly PHP webshell as a foothold on the compromised appliance.

CVE

CVE-2026-102764The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.

Threat Actors

ARMORY CASTLEChina-linked, state-sponsored espionage group reported to have exploited CVE-2026-102764 as a zero-day.

Malware

SAWFLYMandiant and GTIG observed the APT targeting a BeyondTrust device for initial access, deploying the Sawfly webshell and Bareclaw tunneler for interaction with the device, escalating privileges, and moving laterally

Vendors

BeyondTrustA Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state-sponsored espionage operations.

Products

BeyondTrust Remote SupportThe exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.

Tools

Bareclawobserved the APT targeting a BeyondTrust device for initial access, deploying the Sawfly webshell and Bareclaw tunneler for interaction with the device, escalating privileges, and moving laterally within the

Countries

ChinaAccording to Mandiant and Google Threat Intelligence Group (GTIG), CVE-2026-102764 has been exploited as a zero-day by Armory Castle, a China-linked threat actor also tracked as UNC5221 and Warp Panda.

Industries

Governmentfocused on long-term intelligence gathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.Legal servicesgathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.SaaS providersespionage group focused on long-term intelligence gathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.

Related Articles