BeyondTrust Patches Critical Remote Support Zero-Day Exploited by Suspected Espionage Actor
Summary
BeyondTrust says attackers exploited CVE-2026-102764 against two Remote Support appliances before a patch was released. The article details the suspected actor’s post-exploitation activity, affected versions, remediation, and hunting guidance.
Key points
- The unauthenticated Remote Support flaw, CVE-2026-102764, is an improper origin validation vulnerability rated Critical with a CVSS v4.0 score of 9.3.
- BeyondTrust says exploitation began August 29, 2026, affecting one hosted Remote Support instance and one self-hosted appliance; it detected the hosted activity on September 28.
- Google Threat Intelligence Group and Mandiant attributed the exploitation and malware deployment to ARMORY CASTLE, formerly tracked as UNC5221, a suspected PRC-nexus espionage actor.
- Attackers reportedly used the SAWFLY webshell, escalated privileges, sought stored credentials, changed Remote Support permissions, and deployed the BARECLAW tunneler.
- BeyondTrust released patch BT26-05-RS on October 8. Remote Support 26.2.3 and earlier are affected; SaaS instances were patched by October 9. PRA shares affected code, but no exploitation path had been identified.
- The article recommends patching, preserving off-appliance logs and other evidence, rebuilding potentially compromised systems, rotating credentials, and restricting administrative access.
- As of the October 15 analysis, widespread exploitation had not been confirmed.
Article Details
- Vulnerability Types
- Improper origin validation
- Severity
- Critical (CVSS v4.0 9.3)
- Affected Versions
- Remote Support 26.2.3 and earlier
- Privileged Remote Access (affected code; no exploitation path identified by BeyondTrust)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict /login and /appliance administration to trusted networks.
- Limit outbound connectivity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 | SHA-256 of ingredi_ws, identified as the BARECLAW tunneler. |
| SHA256 | dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb | SHA-256 of mangoapi.php, identified as the SAWFLY webshell. |
MITRE ATT&CK
T1070.002 · Clear Linux or Mac System LogsThe actor deleted appliance logs and other records.T1078 · Valid AccountsThe actor used compromised administrator credentials to access the Remote Support portal.T1098 · Account ManipulationThe actor modified startup configuration so the service account retained passwordless administrative privileges after reboot or configuration reset.T1190 · Exploit Public-Facing ApplicationThe actor exploited CVE-2026-102764 in a BeyondTrust Remote Support instance and appliance.T1505.003 · Web ShellThe actor placed and used the SAWFLY PHP webshell in the appliance web root.T1548.001 · Setuid and SetgidThe actor abused SUID permissions to obtain root-level execution.T1572 · Protocol TunnelingBARECLAW provided SOCKS5-over-WebSocket tunneling through the compromised appliance.
CVE
Threat Actors
Malware
Vendors
Products
BeyondTrust Privileged Remote AccessPrivileged Remote Access shares affected code, but BeyondTrust says it has not identified an exploitation path for PRA. The company nevertheless released a precautionary patch and recommends that self-hosted PRABeyondTrust Remote SupportBeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch.HAProxyARMORY CASTLE also deployed BARECLAW (ingredi_ws), a custom SOCKS5-over-WebSocket tunneler, and modified HAProxy configuration to route a specially configured web path to the locally running tunnel.