BeyondTrust Remote Support zero-day exploited since August

Mandiant and Google Threat Intelligence Group (GTIG) say a suspected PRC-nexus espionage actor exploited CVE-2026-102764 in BeyondTrust Remote Support from late August 2026, weeks before a patch existed. The attackers used the appliance's own tooling to dump stored vault credentials. Applying the patch closes the hole, but every secret the appliance held should be treated as exposed.

What happened

GTIG published its analysis on October 15, 2026, the same day the vulnerability was disclosed. It attributes the activity to ARMORY CASTLE, the actor it previously tracked as UNC5221. BleepingComputer adds that CrowdStrike tracks the same actor as Warp Panda. Mandiant describes the flaw as an arbitrary file upload affecting all supported Remote Support versions up to 26.2.3. CISA and BleepingComputer call it an authentication bypass. BleepingComputer also reports that Privileged Remote Access (PRA) shares the affected code. Neither source gives a CVSS score.

The fix is BeyondTrust patch BT26-05 (CISA refers to it as BT26-05-RS). Mandiant says SaaS tenants were patched on October 9, before disclosure. BleepingComputer gives October 8. Self-hosted appliances on 24.3.1 or later need the patch applied from the /appliance interface. Older versions must first upgrade to a supported release. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16 and urged immediate patching, without setting a due date.

After initial access, Mandiant observed the following:

• The SAWFLY PHP webshell and the BARECLAW SOCKS5-over-WebSocket tunneler.
• A SUID-root copy of /bin/sh, plus a post-boot script that added a passwordless sudoers entry.
• Use of the appliance's /ns/sbin/bt-secrets binary to read the vault.
• Compromised accounts raised from No Access to Administrator on Jump Item roles and team permissions, giving standing rights to launch sessions to downstream systems.
• Deletion of appliance auth, HTTP, PHP and system logs.

Why it matters

Remote Support is a privileged access path. It stores credentials, injects them into sessions and holds trust relationships with directories and SAML identity providers. Owning the appliance gives an attacker those secrets and a sanctioned way to reach the systems behind it. BeyondTrust's guidance to self-hosted customers, as reported by BleepingComputer:

"Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed"

Order matters here. Mandiant warns that rotating credentials before the appliance is patched or rebuilt only hands the new secrets to an attacker who may still be inside.

What to check in your environment

• Inventory every Remote Support and PRA instance, self-hosted and SaaS. Confirm the BT26-05 patch on self-hosted appliances, and upgrade anything older than 24.3.1 first.
• If an appliance was internet-reachable on a vulnerable version since late August, follow CISA's steps: isolate it, take forensic snapshots, forward logs to your SIEM, investigate, then rebuild from a known-good state and patch.
• Hunt for Mandiant's indicators: mangoapi.php, /usr/bin/dbus-authd, /home/bomgar/sbin/post_boot.d/zz-root-persist, a /uidchanarge ACL in /ns/config/haproxy.conf, and gaps in syslog forwarding.
• Review audit events user_changed, user_added, api_account and security_provider. Look for Jump Item or team role increases, and for /login successes from residential broadband or commercial VPN ranges.
• Only after patching or rebuilding, rotate credentials in Mandiant's order: /appliance admins, /login admins and local users, API client secrets, security provider bind accounts and SAML signing keys, Vault and integrated Password Safe or PRA credentials (rotated at the target system), integration credentials (SMTP, syslog, ITSM, outbound events), and anything typed into a support session during the window.
• Restrict /login and /appliance by IP or network segment. Require SAML SSO with phishing-resistant MFA for /login users, and enable MFA on the built-in Admin account.
• Set the default Jump Item role to "No Access" in every group policy. Scope API accounts to minimum permissions, and keep only one vaulted break-glass local account.
• Apply default-deny outbound filtering from the appliance, allowing only BeyondTrust endpoints and your own syslog and directory servers.

References

• Google Threat Intelligence / Mandiant: ARMORY CASTLE exploits BeyondTrust Remote Support
• CISA: CISA urges patching critical vulnerability in BeyondTrust Remote Support
• BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August
• BeyondTrust: Two-factor authentication