China-linked Armory Castle exploits a BeyondTrust Remote Support zero-day

On 16 October 2026, BeyondTrust — the Johns Creek, Georgia vendor of privileged-access and remote-support software — disclosed that a suspected China-nexus espionage group had exploited a previously unknown zero-day in its Remote Support appliances. Tracked as CVE-2026-102764 and rated 9.3 on the CVSS 4.0 scale, the flaw is an "improper origin validation" weakness in an internal messaging component that did not adequately validate the origin of messages, letting a remote attacker perform file operations on an affected appliance. The same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory and added the bug to its Known Exploited Vulnerabilities catalog.

According to BeyondTrust's timeline, the group — which Google and Mandiant track as Armory Castle (also known as UNC5221 or Warp Panda) — first exploited the flaw as a zero-day against a single self-hosted appliance on 29 August 2026. The vendor began investigating after exploitation of another security-device provider became public in late September, then pushed patches to all Remote Support SaaS customers on 9 October. Self-hosted customers running versions 24.3.1 through 26.2.3 must manually apply the BT26-05-RS patch, while older installations must first upgrade.

What the attackers did

Google Threat Intelligence Group and Mandiant described a deep, hands-on-keyboard intrusion once the appliance was breached. The attackers copied /bin/sh to a system binary and set SUID permissions to gain root control, attempted to harvest secrets from the appliance's credential store using the bt-secrets CLI, and abused configuration templates for passwordless root access. They then used stolen administrator credentials to launch remote sessions into downstream customer systems and exfiltrate documents, deployed a PHP web shell called SAWFLY and a SOCKS5 proxy called BARECLAW, and deleted system, web-server, and application logs to frustrate detection. To blend in, they routed traffic through commercial VPN exit nodes and compromised home and small-office routers.

A recurring pattern

The incident continues a run of state-linked exploitation of internet-facing security and remote-access appliances, which concentrate privileged credentials and trusted connectivity and so make high-value footholds. BeyondTrust said it was withholding deeper technical detail until customers had time to patch, and it did not disclose how many appliances were ultimately targeted.