China-Linked Hackers Exploited BeyondTrust Bug as Zero-Day

China-linked hackers exploited BeyondTrust’s CVE-2026-102764 vulnerability as a zero-day from Aug. 29 in a state-sponsored espionage campaign. The attacks targeted one BeyondTrust-hosted and one self-hosted Remote Support appliance. BeyondTrust released a fix on Oct. 8.

The vulnerability has a CVSS severity score of 9.3 and involves improper validation of message origins. It could allow attackers to perform file operations on Remote Support appliances. All Remote Support versions up to and including 26.2.3 are affected.

BeyondTrust identified the flaw on Sept. 28, one day after exploitation against a security device provider became public. The company developed a patch by Sept. 30, then tested the update and addressed additional attack paths before releasing it.

The fix is included in the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers using versions older than 24.3.1 must upgrade before applying the patch. BeyondTrust reported that the update had been applied to all Remote Support software-as-a-service customers by Oct. 9. Self-hosted customers without automatic updates must install it manually.

Mandiant and Google Threat Intelligence Group identified the attackers as Armory Castle, a China-linked group also known as UNC5221 and Warp Panda. The group has conducted long-term espionage operations against software-as-a-service providers, technology companies, government organizations, legal services firms and business-process outsourcers.

The attackers used the BeyondTrust appliance to gain initial access, deploy malware and move through the victim’s network. They installed Sawfly, a PHP webshell that supports encrypted, two-way communication with the attackers, and Bareclaw, a custom SOCKS5 tunneler used to proxy network traffic.

After deploying Sawfly, the attackers gained root-level control of the appliance, collected credentials and obtained passwordless root access to the site service account. They also deleted system, web server and application logs, according to Mandiant and Google Threat Intelligence Group.

The attackers then used compromised administrator credentials to access the Remote Support application and change account permissions. They used the appliance’s support tools to obtain full file-system access on remote systems and its file-transfer service to download documents from user desktops. The documents included software inventories that could support further network reconnaissance.

Armory Castle has been active since at least October 2023. Researchers have linked the group to zero-day attacks against Citrix NetScaler, Ivanti Connect Secure and Dell RecoverPoint for Virtual Machines. Its operations have included webshells, backdoors and modified components of edge devices.