China-linked hackers exploited a critical BeyondTrust zero-day to compromise Remote Support appliances, gain root-level control, harvest privileged credentials and pivot toward systems managed through the remote-access platform.
The vulnerability, tracked as CVE-2026-102764, affects BeyondTrust Remote Support and carries a CVSS 4.0 score of 9.3, rated Critical.
Google Threat Intelligence Group and Mandiant attributed the zero-day exploitation to ARMORY CASTLE, a suspected China-nexus cyber espionage actor previously tracked as UNC5221 and also known as WARP PANDA.
BeyondTrust says the actor exploited the vulnerability on August 29, 2026, before a patch or public disclosure was available.
For broader coverage of state-backed intrusion campaigns and advanced persistent threats, see our Nation-State Cyber Warfare and APT Threats 2026 Hub.
Key Takeaway
CVE-2026-102764 is an improper origin-validation vulnerability inside BeyondTrust Remote Support’s internal messaging components.
Under the right conditions, an unauthenticated remote attacker can use the flaw to perform file operations on an affected appliance.
Mandiant’s investigation shows that ARMORY CASTLE turned that capability into a much deeper compromise, installing a web shell, escalating to root, accessing stored credentials, establishing persistent administrative access and using the Remote Support platform to reach downstream systems.
BeyondTrust has released patches and says its SaaS environments have already been remediated. Self-hosted customers should urgently verify that the BT26-05 security update has been applied.
What Is CVE-2026-102764?
CVE-2026-102764 affects internal components of BeyondTrust Remote Support, formerly known as Bomgar.
BeyondTrust says the affected components did not adequately validate where incoming messages originated.
A remote attacker who can reach the vulnerable path may therefore send crafted messages that trigger file operations on the appliance.
The issue is tracked as:
- CVE: CVE-2026-102764
- Severity: Critical
- CVSS 4.0: 9.3
- CWE: CWE-290 — Authentication Bypass by Spoofing
- Affected product: BeyondTrust Remote Support
ARMORY CASTLE Exploited the Flaw as a Zero-Day
The vulnerability was not merely theoretical.
BeyondTrust and Mandiant confirmed that ARMORY CASTLE exploited CVE-2026-102764 before customers had a public advisory or patch information.
BeyondTrust’s incident timeline says the actor exploited the zero-day on August 29, 2026 against one BeyondTrust-hosted Remote Support instance and one self-hosted Remote Support appliance.
The activity was later uncovered through threat hunting after a separate edge-device exploitation campaign became public.
BeyondTrust Detected the Intrusion in September
BeyondTrust says its Cyber Defense team identified indications of the attack on September 28.
The affected hosted instance was contained within 27 minutes of detection.
Within hours, BeyondTrust Product Security had reproduced the attack path in a laboratory environment and engineering teams began developing a fix.
Mandiant separately investigated the self-hosted compromise and shared its findings with BeyondTrust on September 30.
Attackers Installed the SAWFLY Web Shell
After exploiting CVE-2026-102764, ARMORY CASTLE established an interactive foothold on the compromised appliance.
Mandiant identified a lightweight PHP web shell it calls SAWFLY.
The web shell was observed as:
mangoapi.phpSAWFLY uses encrypted command-and-control communication and attempts to hide from automated scanners by returning an HTTP 404 response when the correct request parameter is not supplied.
Once an attacker sends the expected encrypted command, the web shell can decode and execute PHP code on the appliance.
Hackers Escalated From Service Account to Root
The initial web shell operated under a lower-privileged site service account.
ARMORY CASTLE then escalated privileges by copying the system shell:
/bin/shto:
/usr/bin/dbus-authdThe actor changed ownership to root and enabled the SUID permission bit.
This allowed the copied binary to execute with root privileges, giving the attackers host-level administrative control of the appliance.
BeyondTrust Credential Vault Was Targeted
One of the most serious post-exploitation actions involved the appliance’s own privileged credential storage.
Mandiant observed the attackers using BeyondTrust’s proprietary:
/ns/sbin/bt-secretsutility.
The legitimate administrative tool can access passwords, API keys and endpoint credentials stored or brokered by the appliance.
The threat actor attempted multiple command variations to extract both account-specific and appliance-level secrets.
Afterward, the attackers attempted to delete logs associated with use of the utility.
Why a Compromised Remote Support Appliance Is So Dangerous
BeyondTrust Remote Support sits in a highly trusted position inside enterprise environments.
It can provide administrators with access to large numbers of endpoints and may also broker privileged credentials required to reach those systems.
Once attackers control the appliance, they may gain both:
- A map of important internal systems
- Credentials used to access those systems
- Remote-session capabilities
- Administrative access paths
- File-transfer functionality
This makes privileged remote-access infrastructure especially attractive to sophisticated espionage groups.
ARMORY CASTLE Added Persistent Root Access
Mandiant found that the actor did not rely only on the initial web shell.
For longer-term persistence, ARMORY CASTLE modified BeyondTrust configuration templates.
The attackers created a startup script named:
zz-root-persistinside a post-boot directory.
The script altered the appliance’s sudo configuration so that the compromised site service account could execute commands with root privileges without supplying a password.
Because the persistence mechanism targeted configuration templates rather than only the live sudoers file, it was designed to survive reboots and configuration regeneration.
Attackers Manipulated BeyondTrust Jump Item Permissions
After obtaining administrative access to the Remote Support application, the actor modified permissions associated with compromised accounts.
Mandiant observed Jump Item and Team permissions changed from:
No Accessto:
AdministratorJump Items represent devices and systems that administrators can reach through the BeyondTrust platform.
By upgrading these permissions, the attacker gained the ability to launch remote support sessions toward downstream endpoints available through the compromised appliance.
Attackers Reached Internal Endpoints
Mandiant observed ARMORY CASTLE launching Remote Support sessions into internal environments.
After connecting to an endpoint, the actor used BeyondTrust’s legitimate support functionality to request full file-system access.
The attackers then used built-in file-transfer capabilities to collect documents useful for internal reconnaissance, including information about installed software.
This demonstrates why compromise of the remote-access control plane can become a gateway into the wider enterprise network.
BARECLAW Created a Hidden Network Tunnel
The attackers also deployed a custom tunneling utility named BARECLAW.
BARECLAW is written in C and implements a SOCKS5 proxy over WebSockets.
The tool can relay TCP connections between an external attacker and internal network destinations reachable from the compromised appliance.
This effectively turns the BeyondTrust server into a pivot point for lateral movement.
HAProxy Configuration Was Modified
ARMORY CASTLE modified the appliance’s:
/ns/config/haproxy.confconfiguration so internet traffic could reach the BARECLAW tunneler.
The custom proxy listened locally while HAProxy forwarded traffic from a specific external web path into the hidden service.
This design made the tunneling service harder to identify using simple external port scans.
Attackers Deleted Logs to Hide Their Activity
ARMORY CASTLE repeatedly attempted to erase evidence of its presence.
Mandiant observed deletion of:
- Authentication logs
- HTTP access logs
- Web server error logs
- PHP logs
- System messages
- BeyondTrust application logs
- Temporary authentication artifacts
This makes off-appliance logging especially important.
BeyondTrust recommends forwarding appliance and session logs to an external SIEM because locally stored evidence may be deleted or manipulated after host compromise.
Who Is ARMORY CASTLE?
Google Threat Intelligence Group tracks the threat actor as ARMORY CASTLE.
The group was previously known as UNC5221, while CrowdStrike tracks related activity as WARP PANDA.
GTIG assesses the group as a suspected PRC-nexus cyber espionage actor.
The actor has been active since at least October 2023 and has targeted sectors including:
- Government
- Technology
- SaaS providers
- Legal services
- Business-process outsourcing
Its operations appear focused on long-term intelligence collection and persistent access.
The Group Has a History of Zero-Day Exploitation
ARMORY CASTLE has previously been linked to exploitation of vulnerabilities affecting internet-facing enterprise infrastructure.
GTIG has associated the actor with zero-day activity involving products such as Citrix NetScaler and Ivanti Connect Secure.
The group appears particularly interested in edge devices and remote-access platforms because they offer a direct route into otherwise protected enterprise networks.
Researchers Warn Exploitation Could Expand
The confirmed zero-day activity observed before disclosure was targeted.
However, GTIG warns that ARMORY CASTLE has historically moved from selective zero-day exploitation to broader opportunistic scanning and exploitation once vulnerability details become public.
Organizations should therefore not assume that only the initially identified victims are at risk.
Any internet-facing appliance that remained vulnerable during the exploitation window should be investigated carefully.
Which BeyondTrust Versions Are Affected?
BeyondTrust’s BT26-05 advisory lists Remote Support versions:
26.2.3 and earlieras affected.
For customers running Remote Support versions 24.3.1 through 26.2.3, BeyondTrust provides the BT26-05-RS patch.
Customers running versions older than 24.3.1 must upgrade to a supported release before applying the remediation.
BeyondTrust SaaS Customers Have Already Been Patched
BeyondTrust says the BT26-05 update was released to customers in early October.
The company’s incident timeline says SaaS Remote Support and Privileged Remote Access instances were automatically patched on October 8.
The public security advisory states that the Remote Support SaaS environment had been remediated by October 9.
SaaS customers therefore do not need to manually install the appliance patch, but organizations should still review credentials and activity if they were exposed during the earlier compromise window.
What About Privileged Remote Access?
BeyondTrust confirmed Remote Support as vulnerable to CVE-2026-102764.
Privileged Remote Access shares some of the affected code, but BeyondTrust says its internal testing has not found a way to exploit the vulnerability in PRA.
As a precaution, the company still released a patch for self-hosted Privileged Remote Access deployments and recommends customers install it.
That distinction is important: PRA should be patched, but it should not currently be described as confirmed vulnerable in the same way as Remote Support.
This Is Confirmed Zero-Day Exploitation
Unlike many vulnerability disclosures where exploitation is only theoretically possible, CVE-2026-102764 was exploited before public disclosure and before defenders had access to the vulnerability details.
The term zero-day is therefore accurate for the August attack.
The vulnerability is now publicly disclosed and patched, so organizations should not describe it as an unpatched zero-day if the appropriate vendor remediation is available.
Organizations Should Treat Exposed Appliances as Potentially Compromised
Mandiant advises organizations to take a cautious approach if a vulnerable Remote Support appliance was internet-accessible during the exploitation period.
Applying the patch prevents new exploitation of CVE-2026-102764, but it does not remove persistence or credentials that may already have been stolen.
Organizations with suspicious activity should consider rebuilding the appliance from a known-clean and fully patched image rather than relying only on manual cleanup.
Patch Before Rotating Credentials
One particularly important incident-response detail is the order of operations.
If an attacker still controls the BeyondTrust appliance, rotating privileged credentials first could expose the new credentials to the attacker again.
Mandiant recommends patching or rebuilding the compromised appliance before completing full credential rotation.
Rotate Every Credential the Appliance Stored or Brokered
If evidence of exploitation is found, organizations should consider credentials accessible through the appliance exposed.
This can include:
- BeyondTrust administrator credentials
- API client secrets
- SAML-related credentials and signing keys
- Directory bind accounts
- Remote Support Vault credentials
- Integrated Password Safe credentials
- Endpoint administrative accounts
- Credentials entered during remote-support sessions
Those credentials should be rotated after the appliance has been secured.
Review Jump Items and Administrative Permissions
Security teams should inspect configuration changes made during the suspected compromise window.
Pay particular attention to:
- Jump Item roles changed to Administrator
- Team permission changes
- New or modified administrator accounts
- API accounts
- Security providers
- Session policies
- Outbound event destinations
- Unexpected Jumpoints
Any modification without a legitimate change ticket or known administrator should be investigated.
Hunt for SAWFLY and BARECLAW
Mandiant released indicators and YARA detection rules for the custom tooling observed during the intrusion.
Important filenames include:
mangoapi.php— SAWFLY web shellingredi_ws— BARECLAW tunneler
However, GTIG warns that ARMORY CASTLE frequently changes infrastructure and tooling between victims.
Organizations should therefore hunt for behavior as well as exact file hashes.
Behavioral Indicators Worth Investigating
BeyondTrust recommends investigating:
- Unexpected administrative sessions from residential or VPN IP addresses
- Unrecognized PHP or script files in web directories
- Web-service accounts spawning shell processes
- Unauthorized Jump Item or Team permission changes
- Unexpected gaps in external log forwarding
- Unusual file-transfer sessions
- New administrator access with no support ticket
- Unexpected outbound WebSocket connections
Restrict Internet Exposure
Remote-access management interfaces should not be broadly exposed when operationally unnecessary.
BeyondTrust recommends restricting administrative endpoints such as /login and /appliance to trusted network ranges.
Organizations should also use strict outbound filtering so compromised appliances cannot freely connect to arbitrary internet destinations.
Use External Logging
One of the clearest lessons from the incident is that attackers with root-level appliance control can alter local evidence.
Forward:
- System logs
- Authentication logs
- Session events
- Firewall telemetry
- Reverse-proxy logs
- WAF logs
to external systems with sufficient retention.
Those off-box records may become the most reliable evidence after an attacker deletes local logs.
A Different BeyondTrust Vulnerability Was Disclosed Earlier in 2026
This new zero-day should not be confused with the BeyondTrust authentication bypass vulnerabilities CVE-2026-40138 and CVE-2026-40139 disclosed earlier in 2026.
Those issues involved authentication weaknesses under specific configurations and were not the vulnerability ARMORY CASTLE used in the newly disclosed August attack.
CVE-2026-102764 is a separate flaw involving improper origin validation in Remote Support’s internal messaging components and has confirmed in-the-wild zero-day exploitation.
What Security Teams Should Do Now
- Confirm the BT26-05 patch is installed
- Upgrade unsupported Remote Support releases
- Patch self-hosted PRA as a precaution
- Investigate internet-facing appliances exposed before remediation
- Forward appliance logs to an external SIEM
- Review unexpected administrator and Jump Item permission changes
- Hunt for SAWFLY and BARECLAW behavior
- Review support-session file transfers
- Restrict administrative interfaces to trusted networks
- Restrict unnecessary outbound access
- Patch or rebuild before rotating credentials
- Rotate every credential potentially stored or brokered by a compromised appliance
Frequently Asked Questions
What is CVE-2026-102764?
CVE-2026-102764 is a critical BeyondTrust Remote Support vulnerability caused by improper origin validation in an internal messaging component. It can allow a remote attacker to perform file operations on an affected appliance.
Was CVE-2026-102764 actively exploited?
Yes. BeyondTrust, Mandiant and Google Threat Intelligence Group confirmed that ARMORY CASTLE exploited the vulnerability as a zero-day in August 2026.
Who is ARMORY CASTLE?
ARMORY CASTLE is a suspected China-nexus cyber espionage group previously tracked as UNC5221. CrowdStrike tracks related activity as WARP PANDA.
What is the severity of the vulnerability?
BeyondTrust rates CVE-2026-102764 Critical with a CVSS 4.0 score of 9.3.
Which BeyondTrust product is confirmed vulnerable?
BeyondTrust Remote Support is confirmed vulnerable. Privileged Remote Access shares affected code, but BeyondTrust says it has not identified an exploitable path in PRA and patched it as a precaution.
Are BeyondTrust SaaS customers patched?
Yes. BeyondTrust says its SaaS deployments have already received the BT26-05 remediation.
Is installing the patch enough after compromise?
No. A previously compromised appliance may contain persistent attacker access or may already have exposed privileged credentials. Organizations should investigate, rebuild where appropriate and rotate potentially compromised credentials after securing the appliance.
What malware did ARMORY CASTLE deploy?
Mandiant identified the SAWFLY PHP web shell and the BARECLAW SOCKS5 tunneling tool during the BeyondTrust intrusion.
Final Takeaway
The BeyondTrust zero-day CVE-2026-102764 is a high-impact example of why privileged remote-access appliances are attractive targets for advanced espionage groups.
ARMORY CASTLE exploited the flaw before public disclosure, gained host-level control, established persistent root access, targeted credential stores and used legitimate Remote Support capabilities to reach systems deeper inside the victim environment.
BeyondTrust has released patches, but organizations with previously exposed self-hosted appliances should not stop at installation of the update.
They should hunt for evidence of compromise, preserve off-box logs, review administrative changes and treat credentials accessible through a compromised appliance as potentially exposed.
