China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The cyber espionage group known as Armory Castle, which is linked to China and previously referred to as UNC5221 or Warp Panda, has actively exploited a recently identified security flaw in BeyondTrust Remote Support (formerly known as Bomgar) during late August 2026.

This vulnerability, designated as CVE-2026-102764 and rated with a CVSS score of 9.3, involves improper origin validation within an internal messaging component. This flaw provides opportunities for remote attackers to execute file operations on affected appliances.

According to an alert from BeyondTrust issued on Thursday, “The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under certain conditions, this could be exploited to perform file operations on the appliance."

As of October 9, 2026, patches have been distributed to all Remote Support Software as a Service (SaaS) customers. Self-hosted customers operating Remote Support versions ranging from 24.3.1 to 26.2.3 are recommended to manually update to the BT26-05-RS patch. For those using versions earlier than 24.3.1, an upgrade to a more current version is necessary to apply the fix.

BeyondTrust provided a timeline indicating that Armory Castle took advantage of this zero-day vulnerability on a self-hosted Remote Support appliance on August 29, 2026. Subsequently, on September 27, 2026, the public disclosure of the successful exploitation of a different security device provider triggered an investigation aimed at uncovering similar exploitations.

Armory Castle has demonstrated a pattern of leveraging zero-day vulnerabilities, notably in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances, targeting various sectors such as legal services, Software as a Service (SaaS) providers, business-process outsourcing, technology, and government agencies for extended intelligence collection. The group has been engaged in such activities since October 2023.

As stated by BeyondTrust, “The actor selectively uses a zero-day against targeted organizations, and once the vulnerability becomes public knowledge, they typically transition to extensive exploitation of any unpatched instances.” The organization further noted that “Our working assessment indicates that this actor identifies high-value software targets in advance, maintaining an ongoing model of these products within an artificial intelligence context to continually develop exploit chains.”

In addition, Google-owned Mandiant has provided further insights into the exploitation process. Following a successful breach, a lightweight PHP web shell codenamed SAWFLY is deployed, facilitating interactive remote access and secure bi-directional command-and-control (C2) communication.

The operators utilize commercial Virtual Private Network (VPN) exit nodes and compromised home and small-office routers, thus blending their malicious traffic with normal activity. Consequently, they employ the web shell to escalate privileges, gain comprehensive administrative control over the appliance, and ensure that their presence remains undetected during system reboots.

The compromise is largely characterized by methods designed to facilitate credential theft through reading stored secrets within the appliance and using administrative access for further lateral movement. The threat actor’s post-exploitation tactics are detailed as follows:

• Attaining root-level control of the appliance host by duplicating the system shell executable (/bin/sh) to the file path "/usr/bin/dbus-authd," changing its ownership to root, and enabling Set User ID (SUID) permissions, allowing execution with the owner's privileges.
• Attempting to extract credentials directly from the appliance's inherent secrets management database via the proprietary "/ns/sbin/bt-secrets" Command Line Interface (CLI) tool, utilized for managing, storing, and retrieving passwords, API keys, and endpoint credentials.
• Targeting BeyondTrust configuration templates to acquire passwordless root privileges for the site service account.
• Accessing the BeyondTrust Remote Support application to conduct reconnaissance using compromised administrator credentials, and launching remote sessions to downstream systems listed within the appliance's Jump Item list.
• Exploiting elevated administrative privileges to create remote support sessions targeting internal endpoints, thereby gaining full filesystem access to those systems for the purpose of downloading and exfiltrating sensitive internal documents.
• Tunneling traffic through the BeyondTrust appliance using BARECLAW, a C-based custom SOCKS5 proxy tunneler that facilitates TCP connections between remote clients and designated destinations.
• Altering the "/ns/config/haproxy.conf" file to render BARECLAW directly accessible from the internet.
• Obscuring detection mechanisms by systematically deleting logs from system, web server, and application levels.

Researchers from Google Threat Intelligence Group (GTIG) and Mandiant affirmed, “Throughout the intrusion, Armory Castle demonstrated a profound comprehension of BeyondTrust appliance internals, evidenced by their manipulation of proprietary CLI tools, startup configuration templates, and local reverse-proxy routing."

It is imperative that any appliance reachable from the internet that was running a vulnerable version during the stated exploitation window be considered potentially compromised until a thorough review is conducted.