CVE-2026-102764: BeyondTrust Zero

BeyondTrust disclosed on Thursday that a critical vulnerability in its Remote Support product was exploited as a zero-day by a suspected China-nexus espionage group, roughly six weeks before a patch was available.

The flaw, tracked as CVE-2026-102764 , carries a CVSS v4 score of 9.3 and affects all Remote Support versions up to 26.2.3. BeyondTrust’s security advisory BT26-05 describes it as improper origin validation in an internal messaging component: the components did not check where the messages they received came from, which, under the right conditions, lets a remote attacker perform file operations on the appliance.

Exploitation requires no credentials and no user interaction. Google’s Mandiant, which investigated one of the intrusions, said a successful attack results in arbitrary file upload, which can lead to host-level control and access to every credential the appliance stores or brokers.

Mandiant attributes the attacks to ARMORY CASTLE , a suspected PRC-nexus espionage actor it previously tracked as UNC5221. CrowdStrike tracks the same cluster as WARP PANDA, and BeyondTrust said it agrees with the attribution with moderate to high confidence.

The attackers first used the flaw on August 29 against one BeyondTrust-hosted Remote Support instance and one self-hosted appliance, according to BeyondTrust . The company found the hosted intrusion on September 28 while hunting its SaaS fleet after another security vendor’s edge appliances were hit by a separate zero-day, and it contained the instance 27 minutes later.

seven hours after containment, BeyondTrust’s product security team had reproduced the entry point in a lab. Variant analysis then turned up additional paths to the same weakness, which the company closed before shipping the patch on October 8.

The intrusion should have been caught earlier. BeyondTrust said its sensors fired in real time when the attacker escalated privileges, but the built-in triage feature of its third-party detection platform closed the alerts as false positives. The company, which did not name the vendor, said it is working to stop automated triage from closing high-severity signals on its own.

How ARMORY CASTLE took over BeyondTrust appliances

After exploiting the flaw, the attackers sent POST requests to a file named app_84304470%2Ephp , which Mandiant could not recover. 11 minutes later, a new web shell Mandiant calls SAWFLY appeared in the appliance’s Laravel web root.

SAWFLY, saved as mangoapi.php , is a small, obfuscated PHP web shell. Any request missing its secret POST parameter gets a 404 Not Found response, so scanners and crawlers see a missing page. When the parameter is present, the shell decodes the payload with a custom Base32 scheme, decrypts it with RC4 using a hardcoded 32-byte key, runs it as PHP code, and returns the output encrypted the same way.

The web shell ran under the site’s unprivileged service account, so the attackers copied the system shell to /usr/bin/dbus-authd , made root its owner and set the SUID bit. Any user who runs a SUID binary gets the owner’s privileges, which hands the attackers a permanent root shell.

With root access, the attackers turned to bt-secrets , BeyondTrust’s own command-line tool for managing stored passwords, API keys and endpoint credentials. Mandiant said they first tried to dump the vault for the site service account, then the global appliance vault, and then deleted the tool’s log file.

For persistence, the attackers dropped a script zz-root-persist into a directory that the appliance runs at every boot. The script adds a passwordless sudo rule for the service account to BeyondTrust’s sudoers template and forces the appliance to rebuild /etc/sudoers from it. Because the appliance regenerates /etc/sudoers from that template, the backdoor survives reboots and configuration resets that would wipe a direct edit.

The attackers also deleted authentication, web server and application logs throughout the intrusion. Mandiant found its evidence in log files that sit on a LUKS-encrypted partition holding the appliance’s / directory.

What the attackers did inside the victim networks

Using a stolen administrator account, the attackers logged into the Remote Support web portal and raised the account’s Jump Item and Team permissions from No Access to Administrator. Jump Items are the systems an appliance is allowed to reach, so the change gave the attackers standing permission to open remote sessions to every downstream machine on the list.

They then opened support sessions to internal endpoints and used the product’s own file transfer feature to pull sensitive IT documents, such as software inventories, from users’ desktops.

To move traffic through the appliance, ARMORY CASTLE deployed BARECLAW, a tunneler written in C that runs a SOCKS5 proxy over WebSocket. It ran from /tmp/ingredi_ws on local port 19800 with token authentication, XOR-based encryption, and logging switched off.

The attackers then edited the appliance’s HAProxy configuration so that requests for the path /uidchanarge were routed to that local port. The tunnel was reachable from the internet through the appliance’s normal front door, while the listener itself stayed bound to localhost and invisible to external scans. BeyondTrust said the operators connected through commercial VPN exits and hijacked and small-office routers, rotating that infrastructure between victims.

Mandiant said ARMORY CASTLE has been active since at least October 2023 and has previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure. After CVE-2023-46805 and CVE-2024-21887 were disclosed in 2024, the group moved from selective attacks to broad exploitation of unpatched devices, and Mandiant warned organisations to prepare for “potential widespread exploitation” of the BeyondTrust flaw.

BeyondTrust also believes the actor keeps a working model of the products it targets inside an AI context to build exploit chains, citing the depth of product knowledge and speed it observed. The company said it has no forensic proof of this.

How to fix CVE-2026-102764

All Remote Support SaaS instances were patched by October 9, and cloud customers need to take no action on the appliance itself. Self-hosted customers running versions 24.3.1 through 26.2.3 should install patch BT26-05-RS from the /appliance interface if automatic updates are not enabled. Appliances older than 24.3.1 must be upgraded to a supported version before the patch can be applied.

Privileged Remote Access shares the affected code. BeyondTrust said its testing found no way to exploit the flaw in that product, but it released a PRA patch as a precaution and recommends self-hosted customers apply it immediately.

Patching does not undo a prior compromise. Mandiant said any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed, and that compromised or uncertain appliances should be rebuilt from a clean, fully patched image rather than cleaned, because customers cannot audit the host file system, and the persistence survives resets.

Credentials should be rotated only after an appliance has been patched or rebuilt, Mandiant said, since rotating earlier would hand the new secrets to an attacker who still controls the box. That covers appliance and portal admin accounts, API secrets, SAML signing keys, vault and Password Safe credentials, integration secrets, and anything typed into a support session during the window.

For hunting, Mandiant points to user_changed syslog events that raise Jump Item or team roles, admin logins from residential broadband or commercial VPN addresses, unknown .php paths and unexpected WebSocket upgrades at the reverse proxy, and gaps in syslog forwarding that begin and end within a single session. Mandiant has published YARA rules for SAWFLY and BARECLAW, and BeyondTrust asks customers who find evidence of exploitation to open a Sev 1 support request citing “BT26-05.”

This is the second exploited flaw in BeyondTrust’s remote access appliances this year. CVE-2026-1731, a pre-authentication remote code execution bug patched in February, was exploited in attacks that deployed ransomware on vulnerable systems.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!