Back Feeds.Feedburner

Chinese APT Exploited BeyondTrust Vulnerability as Zero

Feeds.Feedburner •Ionut Arghire • October 16, 2026

A Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state- espionage operations.

The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.

According to BeyondTrust, all RS versions up to and including 26.2.3 are affected. Fixes for the bug were included in the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers on releases older than 24.3.1 should upgrade to a newer version and then apply the patch.

BeyondTrust identified the security defect on September 28, one day after its exploitation against a security device provider became public. However, initial exploitation occurred on August 29, against one BeyondTrust-hosted and one self-hosted RS appliance.

The company says it produced a patch by September 30, but took its time to test it and resolve additional exploitation paths before shipping the fix on October 8.

“As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers,” BeyondTrust says , noting that self-hosted customers should manually apply the fix if they do not have automatic updates.

According to Mandiant and Google Threat Intelligence Group (GTIG), CVE-2026-102764 has been exploited as a zero-day by Armory Castle, a China-linked threat actor also tracked as UNC5221 and Warp Panda.

Armory Castle is a state- espionage group focused on long-term intelligence gathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.

Mandiant and GTIG observed the APT targeting a BeyondTrust device for initial access, deploying the Sawfly webshell and Bareclaw tunneler for interaction with the device, escalating privileges, and moving laterally within the compromised environment.

Sawfly, a lightweight PHP webshell that features bidirectional encrypted command-and-control (C&C) communication capabilities, is the threat actor’s primary foothold within the environment.

After deploying the webshell, Armory Castle gained root-level control of the appliance host, harvested credentials, gained passwordless root privileges to the site service account, and systematically deleted system, web server, and application-level logs.

, the attackers pivoted to the RS application using compromised administrator credentials, modified the account’s permissions to gain control of remote systems, and started targeting internal endpoints.

“The threat actor leveraged the appliance’s built-in support tools to request and obtain full file-system access. The threat actor utilized the native BeyondTrust Remote Support file transfer service to download and exfiltrate sensitive internal documents useful for network reconnaissance, such as software inventories, directly from the user’s desktop environment,” Mandiant and GTIG explain.

Additionally, the threat actor was observed using the custom SOCKS5 proxy tunneler Bareclaw, which supports data encryption, traffic chaining to an upstream proxy, and authentication, among others.

“GTIG has previously reported Armory Castle exploiting multiple vulnerabilities in edge appliances and deploying an extensive suite of custom tooling to support their objectives, ranging from passive backdoors and webshells to trojanized components of edge devices. Armory Castle has been active as early as October 2023 and has targeted a wide range of countries and verticals during their operations,” Mandiant and GTIG note.

The threat actor was previously seen exploiting zero-days in Citrix NetScaler ( CVE-2023-4966 , aka CitrixBleed), Ivanti Connect Secure ( CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282 ), and Dell RecoverPoint for Virtual Machines ( CVE-2026-22769 ).

Related: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Related: US Disrupts Chinese State- Hacking Tools

Related: Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Related: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to stored credentials. BeyondTrust disclosed the vulnerability on October 15, 2026, and released a patch on October 8, 2026. The exploitation was first detected on a hosted and a self-hosted appliance, with BeyondTrust's sensors failing to alert due to false positives. Mandiant and Google have warned organizations to treat exposed appliances as potentially compromised and to apply the patch immediately to mitigate risks. The attackers utilized a PHP web shell named SAWFLY for command and control, escalating privileges and establishing persistence within the compromised systems. 14 sources 86

Extracted Entities

Chinese APT Exploited BeyondTrust Vulnerability as Zero

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

CVEs (6)

Industries (2)

Malware (2)

MITRE ATT&CK (3)

Tools (3)

Vulnerabilities (1)