BeyondTrust Remote Support Zero-Day Exploited Since August; Users Urged to Patch
Summary
BeyondTrust says a zero-day in self-hosted Remote Support appliances has been exploited since August. The flaw can enable unauthenticated file operations and potentially host-level access; users are urged to patch.
Key points
- CVE-2026-102764 affects BeyondTrust Remote Support versions up to 26.2.3; the vendor also released a precautionary patch for Privileged Remote Access.
- BeyondTrust says attackers exploited the flaw in Remote Support appliances starting Aug. 29. Google and Mandiant linked the activity to a Chinese government-nexus actor tracked as Armory Castle and Warp Panda.
- The flaw involves inadequate validation of message origins in internal components and can allow unauthenticated remote file operations, potentially leading to host-level control and access to stored or brokered credentials.
- Mandiant reported that the actor attempted to dump credentials, download documents for network reconnaissance, and target other endpoints.
- Researchers said the attackers used the Sawfly webshell and Bareclaw tunneller and deleted appliance logs and endpoint artifacts to maintain access and evade detection.
- BeyondTrust says it patched its SaaS instances on Oct. 8 and urges self-hosted customers to install the update. It advises treating internet-reachable appliances on vulnerable versions during the exploitation window as potentially compromised pending review.
Article Details
- Vulnerability Types
- Improper validation of the origin of messages received by internal components, enabling file operations on the appliance
- Severity
- Critical
- Affected Versions
- BeyondTrust Remote Support up to 26.2.3
- BeyondTrust Privileged Remote Access (same vulnerable code; affected versions not specified)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1003 · OS Credential DumpingAfter exploiting the appliance, the threat actor attempted to dump credentials from its built-in secrets management database.T1018 · Remote System DiscoveryThe actor downloaded documents for network reconnaissance and targeted other endpoints in the victim's environment.T1070.004 · File DeletionThe actor routinely deleted appliance logs and endpoint artifacts to evade detection and maintain access.T1505.003 · Web ShellThe actor used the Sawfly webshell to interact with the BeyondTrust device.T1572 · Protocol TunnelingThe actor used the Bareclaw tunneller to interact with the BeyondTrust device.
CVE
People
Threat Actors
Malware
BARECLAW"The threat actor used newly identified custom malware, the Sawfly webshell and the Bareclaw tunneller, to interact with the BeyondTrust device.SAWFLY"The threat actor used newly identified custom malware, the Sawfly webshell and the Bareclaw tunneller, to interact with the BeyondTrust device.
Vendors
BeyondTrustZero-Day in BeyondTrust Remote Support Appliances ExploitedGoogleIn a coordinated vulnerability report, threat intelligence researchers at Google and its Mandiant incident response group said the threat actor specializes in attacking edge appliances, gaining long-term access andMandiantIn a coordinated vulnerability report, threat intelligence researchers at Google and its Mandiant incident response group said the threat actor specializes in attacking edge appliances, gaining long-term access and