BeyondTrust Remote Support zero-day exploited since August by suspected China-nexus spies

BeyondTrust disclosed on 15 October 2026 that a critical vulnerability in its Remote Support product, CVE-2026-102764, had been exploited as a zero-day. Google Threat Intelligence Group and Mandiant attribute the attacks to ARMORY CASTLE, formerly tracked as UNC5221, which they describe as a suspected China-nexus espionage actor.

What is the vulnerability? #

The flaw is in internal components of Remote Support that "did not adequately validate the origin of the messages" they received, according to the GitHub advisory. It is rated 9.3 (critical) on CVSS 4.0 and classed as authentication bypass by spoofing (CWE-290).

Google says an unauthenticated remote attacker can use it to upload arbitrary files, which can lead to full control of the appliance and access to every credential the appliance stores or brokers. It affects Remote Support versions up to 26.2.3.

BeyondTrust's Privileged Remote Access (PRA) shares the affected code. BeyondTrust says its testing found no way to exploit it there, but it released a PRA patch as a precaution.

Who was attacked, and when? #

BeyondTrust says the flaw was exploited from 29 August 2026 against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Its own team found indications of the attack on 28 September through threat hunting, and Mandiant shared findings from the self-hosted customer on 30 September. BeyondTrust says it knows of only those two affected customers and has seen no attacker activity since August.

BeyondTrust assesses with moderate to high confidence that the actor is ARMORY CASTLE, which CrowdStrike tracks as WARP PANDA. Shadowserver tracks more than 1,400 internet-exposed BeyondTrust Remote Support instances, BleepingComputer reported, though that is exposure, not confirmed compromise.

What did the attackers do on the appliances? #

Which patch fixes it? #

BeyondTrust released patch BT26-05 on 8 October for all supported Remote Support and PRA versions. Cloud (SaaS) instances were patched automatically. Self-hosted customers must apply it themselves. Beazley Security says appliances on version 24.3.1 or later can install it from the /appliance interface, while older appliances must be upgraded first.

What should BeyondTrust customers do? #

1. Apply BT26-05 to self-hosted Remote Support and PRA appliances now.
2. Treat any internet-reachable appliance that was unpatched during the exploitation window as potentially compromised until it has been reviewed, Google advises.
3. Preserve memory and disk snapshots before making changes, and rebuild compromised appliances from a clean, patched image rather than cleaning them, since the persistence survives reboots.
4. Rotate credentials stored in or brokered by the appliance, but only after patching or rebuilding, so an attacker still on the box cannot capture the new ones.
5. Restrict /login and /appliance to trusted networks, limit outbound traffic from the appliance and forward logs to a SIEM in near real time, since the attackers deleted local logs.
6. Hunt for the artifacts Google lists, including /usr/bin/dbus-authd with SUID set, a zz-root-persist startup script and a NOPASSWD entry in sudoers.template. Report suspected compromise to BeyondTrust as a Severity 1 support request citing BT26-05.