BeyondTrust Remote Support Zero-Day Exploited in Espionage Campaign
Summary
BeyondTrust says suspected China-linked actor ARMORY CASTLE exploited CVE-2026-102764 in Remote Support appliances. The article details the attack and recommends patching affected self-hosted systems and investigating appliances exposed while vulnerable.
Key points
- CVE-2026-102764 is an unauthenticated remote vulnerability in BeyondTrust Remote Support, rated CVSS 4.0 9.3; versions up to and including 26.2.3 are affected.
- BeyondTrust and Mandiant attribute observed exploitation to ARMORY CASTLE with moderate-to-high confidence; attacks were observed as early as August 29, 2026.
- Attackers deployed the SAWFLY PHP webshell, escalated to root, attempted to access stored credentials, established persistence, and used the BARECLAW tunneler.
- Mandiant observed the actor accessing internal systems through Remote Support sessions and deleting local logs to hinder investigation.
- Self-hosted Remote Support customers should install the BT26-05-RS patch; older versions must first be upgraded. BeyondTrust said its Remote Support SaaS instances were patched by October 9, 2026.
- Patching does not remove existing malware or persistence. Investigate appliances exposed while vulnerable, preserve external telemetry, and isolate or rebuild systems if compromise is confirmed or cannot be ruled out.
- After containment or rebuilding, rotate privileged credentials and review appliance configuration changes, unexpected files and SUID binaries, suspicious sessions, and gaps in centralized logging.
Article Details
- Vulnerability Types
- Improper origin validation in an internal messaging component, allowing unauthenticated remote file operations
- Severity
- Critical; CVSS 4.0 score 9.3
- Affected Versions
- BeyondTrust Remote Support versions up to and including 26.2.3
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- For self-hosted Remote Support, install the BT26-05-RS patch; versions older than 24.3.1 must first be upgraded to a supported release.
- For self-hosted Privileged Remote Access, apply the corresponding precautionary patch.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 | SHA-256 hash published for the BARECLAW binary. |
| SHA256 | dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb | SHA-256 hash published for the SAWFLY webshell. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe attackers used the appliance's bt-secrets utility to attempt retrieval of passwords, API keys, and other stored credentials.T1021.006 · Windows Remote ManagementThe attackers initiated Remote Support sessions against internal endpoints and requested file-system access.T1070.002 · Clear Linux or Mac System LogsMandiant observed deletion of authentication, web server, application, PHP, and credential-vault access logs.T1090.003 · Multi-hop ProxyBARECLAW provided SOCKS5 tunneling over WebSockets through the compromised appliance.T1098 · Account ManipulationThe attackers modified the sudoers template to grant the compromised service account passwordless root privileges.T1105 · Ingress Tool TransferThe attackers staged malicious files on the appliance, including the SAWFLY webshell and BARECLAW binary.T1505.003 · Web ShellThe attackers installed the SAWFLY PHP webshell in a web-accessible directory for interactive command execution.T1547.010 · Port MonitorsThe attackers created the zz-root-persist startup script under /home/bomgar/sbin/post_boot.d to persist across reboots.T1548.001 · Setuid and SetgidThe attackers copied /bin/sh to /usr/bin/dbus-authd, set it root-owned, and enabled SUID to obtain root command execution.
CVE
Threat Actors
Malware
Vendors
Products
BeyondTrust Privileged Remote AccessSuccessful exploitation can provide attackers with a foothold on an appliance that brokers privileged remote access and may contain or provide access to administrative credentials, API secrets, support sessions, andBeyondTrust Remote SupportBeyondTrust has disclosed CVE-2026-102764, a critical vulnerability in Remote Support (RS) that was exploited as a zero-day by a suspected China-nexus cyber espionage actor.