New Zero-Day Vulnerability in BeyondTrust Exposes Remote Support Systems to Attackers

Organizations using self-hosted BeyondTrust Remote Support products need to prioritize vulnerability management following the discovery of a critical zero-day flaw, now linked to Chinese espionage activities. Mandiant and the Google Threat Intelligence Group (GTIG) highlight that this vulnerability has allowed attackers to gain root-level access, compromise credential vaults, and establish persistence within networks.

Google’s blog post emphasizes the urgent need for organizations to prepare for potential exploitation in light of this disclosure, attributing the zero-day to a threat actor known as ARMORY CASTLE, previously referenced as UNC5221. The exploitation reportedly began in late August 2023, with BeyondTrust officially acknowledging the flaw on the same day it released advisories and patches.

Identified as CVE-2026-102764, this vulnerability received a severe 9.3 score on the CVSS 4.0 scale, impacting Remote Support versions up to 26.2.3. Mandiant alerted that unauthenticated attackers could exploit this weakness to perform unauthorized file operations, granting them full control over the compromised systems.

Detection and Response Challenges

A timeline established by BeyondTrust indicates that the first signs of exploitation were detected on August 29, with malicious activities targeting both a BeyondTrust-hosted instance and a self-hosted appliance. Though BeyondTrust initially detected the intrusion on September 28, it was triggered by an unrelated security event linked to a different vendor's appliances.

“Our sensors triggered simultaneously as the actors escalated their access privileges,” noted BeyondTrust. However, an automated triage process misclassified these alerts as false positives. After identifying the breach, BeyondTrust managed to contain the hosted instance within 27 minutes, indicating issues with automated alert systems in handling high-severity incidents.

Exploitation Methodology

Shortly after the initial breach, a PHP web shell, labeled SAWFLY by Mandiant, was deployed to the appliance’s web root. Mandiant disclosed that the attackers escalated their access by manipulating the underlying system configurations to maintain control even after reboots.

The attackers attempted to extract sensitive stored credentials using various commands meant for BeyondTrust's internal utilities while also erasing numerous system logs to cover their tracks. This showcases a clear strategy to both penetrate the environment and maintain persistence without detection.

Abuse of Internal Tools

Mandiant’s analysis revealed the attackers elevated their privileges significantly by altering Jump Item and Team permissions to obtain full administrative access. This modification granted them unrestricted access, enabling them to initiate remote sessions across other systems under the BeyondTrust management umbrella.

The threat actors implemented a custom SOCKS5 tunneler, BARECLAW, and made structural changes to the appliance’s HAProxy configurations to facilitate covert communications, further complicating detection efforts.

Impact on SaaS Customers

Companies utilizing BeyondTrust’s SaaS model for Remote Support and Privileged Remote Access were automatically patched and do not need additional actions. Mandiant noted that while SaaS deployments received immediate updates, credential rotation and security reviews remain critical for preserving security.

For self-hosted instances running versions older than 26.2.3, organizations must implement the BT26-05-RS patch from the appliance interface, as prior exposures are still a concern despite applying updates.

Ongoing Threats and Recommendations

ARMORY CASTLE's proactivity indicates a shift in tactics that may lead to further zero-day exploit attempts. GTIG’s observations suggest that organizations should maintain vigilance due to the actor's history of efficiently exploiting edge devices.

BeyondTrust’s advisory history reveals a growing trend, marking this as their third critical Remote Support notification in 2023. Earlier vulnerabilities were swiftly targeted following disclosures, hinting that a similar pattern could emerge with CVE-2026-102764.

Mandiant recommends that any affected appliance should be treated as at risk until proper evaluations confirm its integrity. For organizations still running vulnerable instances, it's crucial to snapshot affected appliances before rebooting and to rebuild any compromised systems from secure images while credential rotation is delayed until after patching.