BeyondTrust Remote Support Was Hit by a China-Linked Zero-Day: Your Questions Answered
A China-linked group exploited a BeyondTrust Remote Support flaw as a zero-day starting in late August. Here are the answers on what was hit, who is behind it, and what self-hosted customers need to do now.
Remote support appliances sit on a short path to almost every machine your help desk touches. This week BeyondTrust and Mandiant described how a China-linked group used a previously unknown flaw in BeyondTrust Remote Support to take over appliances, steal credentials, and reach systems listed in the appliance’s jump items.
This FAQ draws on The Hacker News report of BeyondTrust’s and Mandiant’s findings and SecurityWeek’s write-up of the same disclosure.
What is the flaw?
CVE-2026-102764 scores 9.3. BeyondTrust describes improper origin validation in an internal messaging component of Remote Support (formerly Bomgar). Under the right conditions, a remote attacker can use that gap to perform file operations on the appliance.
Who exploited it, and when?
Google-owned Mandiant and Google Threat Intelligence Group attribute the activity to Armory Castle, also tracked as UNC5221 or Warp Panda. BeyondTrust’s timeline puts first exploitation on August 29, 2026. The Hacker News describes a single self-hosted appliance on that date; SecurityWeek says one BeyondTrust-hosted and one self-hosted appliance were involved. The company says it identified the defect on September 28 after exploitation against another security-device provider became public, built a patch by September 30, and shipped the fix after further testing on October 8, with SaaS customers patched as of October 9.
What happens after a successful break-in?
Mandiant describes a lightweight PHP web shell called SAWFLY (also written Sawfly) for interactive access, then privilege escalation to root, use of BeyondTrust’s own bt-secrets tooling to harvest stored secrets, abuse of administrator sessions and jump items to reach downstream systems, and a custom SOCKS5 tunneler called BARECLAW (Bareclaw). Logs at the system, web-server, and application levels were deleted to slow detection. Mandiant’s advice: any appliance that was reachable from the internet on a vulnerable build during the window should be treated as potentially compromised until it has been reviewed.
Which versions need action?
SecurityWeek summarizes BeyondTrust’s scope as all Remote Support versions up to and including 26.2.3. Self-hosted customers on 24.3.1 through 26.2.3 should apply the BT26-05-RS patch; anyone on a build older than 24.3.1 must upgrade first, then patch. SaaS customers were updated by BeyondTrust.
Why does this group keep showing up?
Armory Castle has a record of selective zero-day use against edge appliances—Citrix NetScaler, Ivanti Connect Secure, and Dell RecoverPoint for Virtual Machines among them—then broader scanning once a bug is public. BeyondTrust’s working assessment is that the actor keeps working models of high-value products and develops exploit chains over time. Targets have included legal services, SaaS providers, business-process outsourcers, technology firms, and governments.
What this means for your company
If your team uses a remote-support or privileged-access appliance that can reach desktops and servers, treat it like a domain controller: keep it off the public internet unless there is no alternative, patch on a calendar, watch admin logins, and have a plan to rebuild if you ever find a web shell. Vendors patch SaaS tenants for you; self-hosted boxes wait on your staff. Ask your provider this week which product and version you run and whether BT26-05-RS (or the equivalent for your stack) is already applied.
Need help reviewing remote-support appliances and confirming they are patched and not internet-exposed? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
