Chinese state-linked hackers spent roughly seven weeks inside a critical BeyondTrust Remote Support zero-day before the company disclosed it on October 15, 2026. The bug, tracked as CVE-2026-102764, carries a CVSS 9.3 critical score under CVSS 4.0, and it sits in a product built to hold the keys to other systems. On October 16, CISA added it to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation.
Mandiant and Google Threat Intelligence Group traced the intrusions to ARMORY CASTLE, a China-nexus espionage cluster also tracked as UNC5221 and WARP PANDA. The first observed exploitation happened on August 29, 2026, against one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust says it found the activity on September 28, and Mandiant said it confirmed the self-hosted compromise on September 30.
Which BeyondTrust Remote Support versions are affected
The vulnerable code covers Remote Support versions 24.3.1 through 26.2.3. Privileged Remote Access shares the affected code, so administrators running that product should check it too. BeyondTrust released the fix under advisory BT26-05 on October 8, 2026, and SaaS deployments were patched by then.
That left self-hosted customers with about a week to act on a available fix before the flaw became public. BankInfoSecurity quoted Joe Toomey, vice president of underwriting security at cyber insurer Coalition: "If you run BeyondTrust Remote Support, you should patch ASAP."
The flaw also has two names in circulation. CISA's catalog entry describes an authentication bypass by spoofing, while researchers at watchTowr describe an arbitrary file upload. Both descriptions lead to the same practical problem: an unauthenticated remote attacker can perform file operations on the appliance.
How the attackers got in and what they left behind
After gaining access, the attackers did more than drop a single tool. Reporting from Cybersecurity News and GBHackers describes a sequence that included the following steps.
- Planting a PHP webshell called Sawfly and a SOCKS5 tunneler called Bareclaw.
- Escalating privileges to root on the appliance.
- Trying to pull credentials from the appliance's secrets store.
- Changing a compromised administrator's permissions so the attackers could reach downstream systems.
- Transferring internal files, including software inventories.
- Deleting authentication, web-server, application and system logs.
The log deletion matters most for defenders. A clean log view does not prove the appliance is safe, because the evidence that would reveal an intrusion may already be gone. That is why the response steps below put log preservation ahead of any cleanup.
Google's threat intelligence team did not soften its timeline. In its analysis, Google Threat Intelligence Group stated: "Armory Castle exploited this vulnerability as a zero-day, in late August 2026."
Why remote-support appliances are such attractive targets
Remote Support brokers privileged access to other systems. A compromise can expose stored passwords, API keys and active session access, which gives an attacker a way to move beyond the appliance itself. Credential theft and lateral movement are the core risks for any organization that depends on the tool.
The product has a history of this kind of targeting. A Technology.org report on the product's past says a China-linked group stole an API key for the Remote Support SaaS service in December 2024 and used it to reach US Treasury workstations and unclassified documents. Earlier in 2026, another critical flaw in the same product, CVE-2026-1731, was actively exploited to plant backdoors.
Google says this group has a history of targeting internet-facing security appliances with previously unknown flaws. That pattern is not unique to BeyondTrust. USA 24 recently reported that PEERSTITCH malware reached 500 FortiGate firewalls through a FortiOS flaw, another case of attackers targeting edge devices that sit between the internet and internal networks.
What CISA's directive means for federal agencies and contractors
CISA's binding directive, BOD 26-04, requires federal civilian agencies to prioritize KEV-listed flaws on exposed systems that allow full control after exploitation. This flaw fits that description. CISA also encourages all organizations to follow the same approach, which makes the KEV listing a useful signal for private companies even though the directive does not bind them.
Federal civilian agencies must remediate under the KEV process. Any agency or contractor that runs BeyondTrust Remote Support is directly exposed. The sources reviewed do not report whether any federal agency was breached through this flaw.
The volume of new listings adds pressure. A third-party tracker, Senserva, counted nine CVEs added to KEV in the seven days ending around October 19, spread across eight vendors. A remote-access patch now competes with every other item in that queue. For a parallel case in collaboration software, see USA 24's coverage of the Atlassian CVE-2026-21589 attacks.
Attackers gain persistent footholds in administrative tooling, which is valuable precisely because it is trusted. Managed service providers and IT help desks may carry the heaviest risk, since one appliance can hold credentials for many client environments at once.
How to check whether your BeyondTrust server was compromised
The order of these steps matters. Preserve evidence first, then patch, then hunt, then rotate.
- Export logs and telemetry before you change anything. Forward them to an external SIEM, since local logs can be wiped.
- Patch to the BT26-05 fixed release. SaaS customers were patched on October 8.
- If an internet-exposed appliance stayed unpatched after late August, treat it as potentially compromised, not merely vulnerable.
- Hunt for the Sawfly webshell and Bareclaw tunneler, unexpected changes to Jump Item or Team permissions, admin sessions from residential or VPN addresses, and unknown scripts in web directories.
- Rotate every credential the appliance could reach, but only after the system is secured.
Open questions and what comes next
Several facts remain unsettled. The number of victims is not public, and the two observed initial intrusions are the only confirmed victims in the sources reviewed. BeyondTrust assesses attribution with moderate-to-high confidence, and Mandiant and Google assess the activity as China-nexus. No official US government attribution appeared in the sources reviewed.
The dates also differ slightly across reports. BeyondTrust's September 28 discovery date and the late-August first exploitation both appear in coverage, and no independent timeline has surfaced. Public exploit details remain limited, but researchers expect broader opportunistic exploitation as the patch is reverse-engineered, a risk Google flagged once the bug became public.
Three developments are worth watching. The first is whether BeyondTrust or CISA publishes a fuller timeline. The second is whether the US government formally names the actor. The third is whether scanning for exposed appliances climbs in the coming days. Administrators who have not yet patched should assume the attackers had a seven-week head start and act accordingly.
