BeyondTrust Remote Support Zero-Day CVE-2026-102764 Was Exploited by Chinese Espionage Actors Since August — Armory Castle Went From Web Shell to Root and Wiped the Logs
BeyondTrust Remote Support Zero-Day CVE-2026-102764 Was Exploited by Chinese Espionage Actors Since August — Armory Castle Went From Web Shell to Root and Wiped the Logs
A China-linked espionage group ran a zero-day in BeyondTrust Remote Support for six weeks before a patch shipped. The flaw, CVE-2026-102764 (CVSS 9.3), is an improper validation of message origins that allows file operations on Remote Support (RS) appliances, and BeyondTrust says initial exploitation happened on August 29 against one BeyondTrust-hosted and one self-hosted RS appliance. All RS versions up to and including 26.2.3 are affected; fixes went into the BT26-05-RS patch released October 8. SaaS customers were fully patched by October 9, but self-hosted deployments must apply the fix manually — and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 16, with a three-day federal deadline.
Mandiant and Google's Threat Intelligence Group attribute the activity to Armory Castle — also tracked as UNC5221 and Warp Panda — a state-sponsored espionage group active since at least October 2023 that pursues long-term intelligence gathering from SaaS providers, technology companies, government entities, legal services, and business-process outsourcers. In the observed intrusions, the actors gained initial access through the RS appliance, planted the Sawfly webshell (a lightweight PHP implant with bidirectional encrypted command-and-control) alongside the custom Bareclaw SOCKS5 proxy tunneler, escalated to root-level control, harvested credentials, and then systematically deleted system, web server, and application-level logs.
From there the actors pivoted into the Remote Support application itself using compromised administrator credentials, modified account permissions to take control of remote systems, and abused the appliance's built-in support tools to request full file-system access. They then used Remote Support's native file transfer service to exfiltrate sensitive internal documents — software inventories useful for network reconnaissance — directly from users' desktop environments. BeyondTrust identified the defect on September 28, one day after exploitation against a security-device provider became public, produced a patch by September 30, and spent the remaining days testing it and closing additional exploitation paths before shipping it on October 8.
The targeting fits a pattern GTIG has documented for years: Armory Castle previously exploited zero-days in Citrix NetScaler (CVE-2023-4966, CitrixBleed), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282), and Dell RecoverPoint for Virtual Machines (CVE-2026-22769), always with an extensive suite of custom tooling — passive backdoors, webshells, and trojanized edge-device components. Remote support platforms are a natural next target: they hold credentials for thousands of endpoints and, by design, can reach into all of them.
What Should You Do?
- Patch now if you haven't — apply BT26-05-RS to Remote Support 24.3.1 through 26.2.3, or upgrade older releases first and then patch. Self-hosted appliances do not auto-update; if you run RS on-premises, you are the update mechanism.
- Hunt for the intrusion pattern — Sawfly webshell artifacts, Bareclaw tunnel processes, new or modified administrative credentials, and — critically — gaps in system, web server, and application logs, which the actors wiped behind themselves.
- Review file-transfer and support-tool session history from late August through patch day for bulk exfiltration from desktop environments; the file transfer service was the exit door.
- Treat remote support as edge infrastructure — restrict its management interfaces, and ship appliance logs to external storage so an intruder with root cannot erase the trail.
The WAF Angle
An "improper validation of message origins" that becomes arbitrary file operations is request-level abuse — a WAF profile tuned to the appliance's API surface can constrain what reaches Remote Support, but the structural lesson is bigger: this is the same edge-appliance exploitation wave as the Ivanti zero-day chain we covered on October 13 and the NetScaler zero-days before it, by an actor that has hit all three vendor families. Remote support tools compound the blast radius because their privilege extends into every endpoint they manage. And the log-wiping is the detail web defenders should internalize: keep WAF, CDN, and SIEM copies of appliance activity outside the appliance itself, because the only evidence that survived this campaign lived where the attacker couldn't delete it.
