BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers

BeyondTrust on Thursday urged customers to patch a critical vulnerability in its Remote Support (RS) product after confirming that attackers have exploited the flaw as a zero-day since late August.

BeyondTrust Remote Support flaw enables unauthorized file operations

Remote Support is BeyondTrust’s enterprise-grade solution for IT service desks, help desks, and customer support teams that need to troubleshoot systems remotely.

Tracked as CVE-2026-102764, the vulnerability is an actively exploited authentication bypass flaw. It could allow an unprivileged remote attacker to perform file operations on an unpatched appliance.

The vulnerability affects Remote Support versions 26.2.3 and earlier. BeyondTrust patched the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8. Organizations with self-hosted installations must apply the security update manually if automatic updates are not enabled.

Armory Castle exploited the vulnerability in zero-day attacks

BeyondTrust released limited technical details about the flaw but said it was exploited by a China-linked espionage group tracked by Mandiant and the Google Threat Intelligence Group (GTIG) as Armory Castle, formerly UNC5221. CrowdStrike tracks the group as Warp Panda.

According to Mandiant researchers who discovered the attacks, Armory Castle exploited CVE-2026-102764 to gain initial access and escalate to root privileges on compromised appliances by enabling the Set User Identity (SUID) permission.

The attackers then deployed the Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through victims’ networks using compromised administrator credentials. They did this by opening remote sessions on downstream systems.

“After establishing a foothold through a web shell, the attacker escalated from the web service account to root-level control of the appliance host. This gave the attacker access to all credentials stored or intermediated by the appliance, and allowed him to modify files that persisted across reboots and configuration resets,” Mandiant said.

“Appliances that were accessible from the internet with a vulnerable version during the period of exploitation should be treated as potentially compromised until reviewed.”

More than 1,400 BeyondTrust instances exposed online

Internet threat watchdog Shadowserver tracks more than 1,400 BeyondTrust Remote Support and Privileged Remote Access instances exposed online.

However, the available data does not show how many of those systems have been secured or how many are honeypots.

Armory Castle has targeted other enterprise appliances

Armory Castle has previously exploited vulnerabilities in various enterprise appliances, including Citrix NetScaler systems affected by CVE-2023-4966 and Ivanti Connect Secure appliances affected by CVE-2023-46805, CVE-2024-21887, and later CVE-2025-0282.

The group has infiltrated corporate networks and deployed custom malware since at least October 2023.

Threat intelligence company Volexity also reported in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor web shell. The attack chained the CVE-2023-46805 and CVE-2024-21887 zero-day vulnerabilities.

“In past campaigns, ARMORY CASTLE conducted widespread and opportunistic exploitation after vulnerabilities that were selectively exploited as zero-days were made public, rushing to infiltrate target organizations before patches were deployed,” Mandiant added. “We may observe similar widespread exploitation attempts related to CVE-2026-102764.”

BeyondTrust has faced repeated exploitation attempts

CVE-2026-102764 is the latest in a series of BeyondTrust vulnerabilities exploited in the wild in recent years.

Most recently, attackers exploited another critical remote code execution vulnerability, CVE-2026-1731, affecting the Remote Support and Privileged Remote Access appliances. The attackers used the flaw to establish a WebSocket channel and deploy ransomware.

Attackers linked to the Chinese state-sponsored Silk Typhoon hacking group are also believed to have exploited two zero-day vulnerabilities, CVE-2024-12356 and CVE-2024-12686, to infiltrate BeyondTrust’s systems.

They used stolen API keys to compromise 17 Remote Support SaaS instances, including one used by the U.S. Treasury Department.

During the same campaign, Silk Typhoon also targeted the Office of Foreign Assets Control (OFAC), which administers the U.S. sanctions program, and the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments for national security risks.

BeyondTrust provides identity security services to more than 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report