BeyondTrust zero-day exploited since August by China-linked hackers

BeyondTrust has patched an authentication-bypass zero-day, tracked as CVE-2026-102764, that a suspected China-nexus espionage group has been exploiting in BeyondTrust Remote Support since late August 2026, according to research from Mandiant and the Google Threat Intelligence Group published this week. The flaw affects BeyondTrust Remote Support (RS) version 26.2.3 and earlier; Privileged Remote Access SaaS customers were covered automatically.

Mandiant and Google's threat intelligence team attribute the attacks to a group they call Armory Castle, previously tracked as UNC5221 and known to CrowdStrike as Warp Panda. In observed intrusions, the attackers used the authentication bypass to reach unpatched appliances, then deployed a web shell to escalate from an unprivileged remote position to full root access. From there they installed two custom malware families, Sawfly and Bareclaw, wiped logs to cover their tracks, and moved laterally through victim networks using compromised administrator credentials.

The severity comes from what a BeyondTrust Remote Support appliance is designed to hold: root access exposes every credential the appliance stores or brokers on behalf of the organizations using it for privileged remote access. Mandiant is advising that any internet-reachable appliance running a vulnerable version during the roughly seven-week exploitation window be treated as potentially compromised until it has been independently reviewed, rather than assumed safe simply because it has since been patched. Security scanning service Shadowserver counted more than 1,400 BeyondTrust Remote Support instances currently exposed to the internet.

BeyondTrust pushed the fix to its SaaS customers on October 8, 2026. Organizations running self-hosted installations without automatic updates enabled must apply the patch manually, and the roughly week-long gap between the SaaS fix and this week's public disclosure gave administrators of self-hosted instances limited advance warning before attackers presumably noticed the same patch notes.

Remote support and privileged access tools are an increasingly attractive target precisely because they are built to be trusted with elevated access across many other systems — a single successful bypass here does not just compromise one machine, it potentially hands an attacker the keys to everything that appliance was trusted to manage, as first reported by BleepingComputer.