Critical BeyondTrust Privilege Management Vulnerability Exploited Since August

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support was actively exploited by a suspected China-linked espionage group, ARMORY CASTLE, starting in late August.
• The flaw allowed unauthenticated attackers to perform file operations, escalate privileges to root, and access credentials on affected appliances.
• BeyondTrust released a patch on October 8, affecting supported Remote Support versions up to and including 26.2.3. All SaaS tenants have been updated, but self-hosted customers must apply the patch manually.
• The exploitation highlights the critical need for immediate patching and rigorous monitoring of internet-facing edge devices, as they can serve as pivotal entry points into internal networks.

BeyondTrust Remote Support Zero-Day Under Active Exploitation

A severe zero-day vulnerability within BeyondTrust Remote Support was exploited by a sophisticated threat actor weeks before the security flaw was publicly disclosed and a patch made available. The vulnerability, identified as CVE-2026-102764, was leveraged by the suspected China-nexus espionage group, ARMORY CASTLE, to gain unauthorized access to appliances, elevate privileges to root, and compromise credentials managed or stored by the product.

According to Mandiant, the vulnerability enables an unauthenticated remote attacker to execute arbitrary file operations on a vulnerable appliance, potentially leading to complete control over the host system. The flaw impacts BeyondTrust Remote Support versions up to and including 26.2.3. BeyondTrust indicated that the root cause lies within an internal messaging component that failed to adequately validate the origin of messages.

While BeyondTrust has withheld specific technical details to protect unpatched customers, Mandiant’s investigation has shed light on the attackers’ methodology. Threat actors exploited their initial access to install malware, escalate privileges, and subsequently pivot into victim networks.

Chronology of Exploitation and Remediation

BeyondTrust confirmed that the vulnerability was first exploited on August 29 against both a hosted Remote Support instance and a self-hosted appliance. The company’s internal threat hunting efforts subsequently detected suspicious activity on a hosted instance on September 28, following reports of a separate attack targeting a different security product, which prompted a broader investigation.

The incident was contained by BeyondTrust within 27 minutes of detection. BeyondTrust released a patch on October 8, with Mandiant confirming that all Remote Support SaaS tenants were updated by October 9. Organizations utilizing self-hosted appliances are urged to promptly review their systems and apply the necessary updates.

Attribution to ARMORY CASTLE

Mandiant has attributed the malicious activity to ARMORY CASTLE, an espionage actor previously tracked as UNC5221 and also known as WARP PANDA by CrowdStrike. This group has a history of targeting edge devices and remote-access solutions. Mandiant warns that following public disclosure of such vulnerabilities, broader, opportunistic exploitation attempts by various actors are likely.

This incident mirrors previous campaigns against edge appliances, where vulnerabilities provide a critical entry point into systems situated between the internet and an organization’s internal network. Such cases underscore the necessity of treating these devices with the same urgency for patching and monitoring as other internet-facing servers.

Attack Methodology and Impact

Mandiant’s analysis revealed that the attackers exploited the vulnerability to upload files, including a PHP web shell named SAWFLY, onto the appliance. A web shell facilitates remote command execution on a compromised web server.

Using the web shell, the attackers interacted with the device and escalated their privileges from a low-privilege service account to root, achieving the highest level of control. This was accomplished by copying a shell program, changing its ownership to root, and setting a permission to allow it to execute with the owner’s privileges.

To maintain persistent access, the threat actors configured a startup script that modified a system template, granting the service account password-free administrative access. They also attempted to exfiltrate secrets from the appliance’s credential store. Given that Remote Support can manage or pass privileged credentials to other systems, a compromise of the appliance could expose accounts beyond the device itself.

Mandiant also identified another tool, BARECLAW, which established a network tunnel through the device. The actor further modified the appliance’s reverse-proxy configuration to redirect specific web traffic through this tunneler. Within the Remote Support application, administrator credentials were used to elevate permissions for accounts’ Jump Items and Teams, which control access to specific computers and groups. These modifications enabled remote sessions to internal systems, facilitating the collection of documents and software inventory information via file transfer features.

The attackers also engaged in anti-forensic measures, deleting system, web, and application logs, as well as traces of their tools. This action can significantly hinder incident response efforts by leaving an incomplete forensic record on the compromised appliance.

What You Should Do

• Apply Patches Immediately: BeyondTrust hosted customers are already patched. Self-hosted organizations must apply the BT26-05-RS update without delay. Mandiant advises customers running versions older than 24.3.1 to upgrade to a supported version before applying the patch. A precautionary patch for Privileged Remote Access has also been released due to shared code, though no active exploitation in PRA has been identified.
• Assume Compromise for Vulnerable Systems: Treat any internet-reachable appliances that ran a vulnerable version as potentially compromised until a thorough review can confirm otherwise. Patching closes the entry point but does not undo prior exploitation.
• Incident Response Protocol: If compromise is confirmed or suspected, preserve all evidence, isolate the affected appliance, and rebuild it from a clean, patched image. Do not merely delete suspicious files.
• Credential Rotation: After securing or rebuilding the appliance, rotate all credentials that were stored on or handled by the device.
• Investigate Accessed Systems: Thoroughly investigate any internal systems that were accessed through the compromised appliance.
• Enhanced Logging and Monitoring: Review logs sent to a separate logging or security platform, along with firewall, reverse-proxy, and web application firewall records. Look for unfamiliar administrator sessions, unexpected account or permission changes, unusual file transfers, unknown scripts, and any gaps in log forwarding.
• Off-Device Logging: Implement off-device logging for all critical security appliances to ensure forensic data persists even if the device itself is tampered with.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.