A critical flaw in BeyondTrust Remote Support was exploited as a zero-day for weeks before a fix shipped, according to disclosures released this week by BeyondTrust and by Google Threat Intelligence Group and Mandiant. Investigators attribute the activity to Armory Castle, a suspected China-nexus espionage actor also tracked as UNC5221 and Warp Panda.
The vulnerability, CVE-2026-102764, carries a CVSS score of 9.3. It stems from improper validation of message origins inside an internal messaging component. Under the right conditions, a remote attacker who needs no credentials can perform file operations on an affected appliance — a serious problem for a product designed to broker privileged remote access into enterprise systems.
BeyondTrust says all Remote Support versions up to and including 26.2.3 are affected. The first known exploitation was on August 29, against one BeyondTrust-hosted instance and one self-hosted appliance. The company found the flaw on September 28 while hunting its own fleet after exploitation of another vendor's security devices became public, had an initial patch ready by September 30, and shipped it on October 8 after further testing. Cloud customers were patched by October 9.
What investigators found inside compromised systems explains the urgency. After initial access, the actor deployed custom tools, including a PHP web shell called Sawfly for encrypted command-and-control and a SOCKS5 tunneler called Bareclaw. The intruders escalated to root-level control, targeted the appliance's secrets store to harvest credentials, moved laterally with administrator access, and used the product's own file-transfer service to download internal documents useful for reconnaissance. System and application logs were also deleted, complicating later review.
That pattern fits Armory Castle's history. Active since at least October 2023, the group has previously been linked to zero-day exploitation of edge and remote-access products from Citrix and Ivanti, among others. Its reported targets include legal services, government, technology companies, software-as-a-service providers, and business-process outsourcers — organizations where long-term, quiet access can be more valuable than a quick smash-and-grab.
For defenders, patching is only the first step. Self-hosted customers on versions 24.3.1 through 26.2.3 should apply the BT26-05-RS patch now if they have not already; systems older than 24.3.1 must first upgrade to a newer release. BeyondTrust notes that Privileged Remote Access shares the affected code, says it has not identified an exploitation path there, and has still released a precautionary patch.
Because exploitation began in late August and the group worked to erase evidence, any internet-reachable appliance that ran a vulnerable version during that window should be treated as potentially compromised. Teams should review logs dating back to late August, forward appliance logs to their SIEM going forward, restrict administrative interfaces to trusted networks, and rotate credentials the appliance stored or brokered. Google's analysts caution that only a small number of impacted organizations are known so far, but the stealth of the campaign means others may have been hit before disclosure.
The lesson for enterprise IT is familiar and still hard: the tools that grant the deepest access need the fastest patching and the closest monitoring. When a remote-support appliance falls, it does not just open one machine — it can hand an espionage group the keys, the map, and a head start of more than a month.