China-Linked Armory Castle Exploited BeyondTrust Zero-Day for Seven Weeks

Attackers spent about seven weeks inside BeyondTrust Remote Support appliances before the vendor disclosed the flaw. The China-linked espionage group Armory Castle exploited a zero-day, tracked as CVE-2026-102764, to gain root-level control of remote-access servers that enterprises and government agencies use to manage privileged access. BeyondTrust published advisory BT26-05 on October 15, 2026. Its fix is already live for cloud customers, but self-hosted customers must apply it by hand.

How the BeyondTrust zero-day unfolded

The first confirmed exploitation began on August 29, 2026, against two appliances: one hosted by BeyondTrust and one self-hosted, according to SecurityWeek. BeyondTrust did not spot the activity until September 28. It found the intrusion hours after a separate zero-day campaign against another vendor's edge appliances became public, and Mandiant sent it a brief alert, according to BankInfoSecurity.

BeyondTrust had a fix drafted by September 30. It held the patch until October 8 so it could test the update and close additional exploitation paths, SecurityWeek reported. That delay is the part of the timeline defenders will question. A patch that existed for more than a week before release gave customers no warning, and the attackers kept working in the meantime.

Mandiant and Google Threat Intelligence Group tied the zero-day to Armory Castle, a China-linked espionage actor also tracked as UNC5221 and Warp Panda, per The Hacker News. Attribution is firm in the Mandiant and GTIG reporting. The sources reviewed do not show U.S. government confirmation, so the attribution rests on private-sector research for now.

What the BeyondTrust flaw lets attackers do

The bug is an improper origin validation flaw in an internal messaging component. An unauthenticated remote attacker can use it to perform file operations on an affected appliance. The vulnerability carries a CVSS score of 9.3, rated Critical, and no conflicting score appeared in the reporting.

Once inside, the attacker deployed a SAWFLY webshell and escalated to root, according to SOC Prime. One analysis also reported that the attacker enabled SUID permissions, deployed the Bareclaw tunneler and erased logs. Log erasure makes the forensic work harder, which is why the hunt guidance below focuses on gaps in the record as well as on the webshell itself.

The attacker also tried to dump credentials from the appliance's built-in secrets database. That database holds passwords, API keys and endpoint credentials. The attacker moved toward other endpoints inside victim networks, BankInfoSecurity reported. Remote-access appliances hold credentials and reach internal networks, which is exactly why attackers target them. The product was formerly known as Bomgar, according to WindowsForum.

Which Remote Support versions need the BT26-05 patch

The affected range is Remote Support 26.2.3 and earlier. The patch package for self-hosted installs is BT26-05-RS. The table below summarizes what each deployment type should do.

BeyondTrust's own statement on the SaaS rollout reads: "As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers." The company has not named individual customers or said how many appliances it patched.

The vendor also says it has not found a working method to exploit the flaw against its Privileged Remote Access product. It issued a precautionary patch for that product anyway, according to SOC Prime.

Practical steps for Remote Support administrators

Start with these steps, drawn from the reporting:

• Confirm the installed version of every Remote Support appliance your organization runs, including appliances used by managed service providers.
• If the appliance is self-hosted, apply BT26-05-RS. If it runs a version older than 24.3.1, upgrade first.
• Treat any appliance exposed to the internet between August 29 and October 8 as possibly compromised until someone has reviewed it.
• Hunt for the SAWFLY webshell, and review logs for gaps or signs that someone erased them.
• Rotate passwords, API keys and endpoint secrets stored in the appliance, since the attacker targeted that database.

Why the Treasury breach and the IMF finding raise the stakes

The threat did not start with this zero-day. According to Technology.org, a China-linked group stole an API key for the Remote Support SaaS service in December 2024 and used it to breach the U.S. Treasury. Earlier in 2026, another critical flaw in the same product, CVE-2026-1731, was actively exploited.

The same coverage cited an IMF finding that in more than 70 percent of 2026 cases recorded, vendors had almost no time to patch before exploitation began. A seven-week head start is a large advantage for an attacker, and that pattern is the core problem here.

Joe Toomey, vice president of underwriting security at the cyber insurer Coalition, gave the blunt advice: "If you run BeyondTrust Remote Support, you should patch ASAP." That quote appeared in BankInfoSecurity's coverage.

The risk is uneven. Companies, IT teams and managed service providers that run the product on premises carry the most exposure, because they have to patch their own boxes. Federal agencies and contractors are exposed as well, given the earlier Treasury breach tied to the same product. USA 24 has tracked similar pressure on other edge products, including the Palo Alto PAN-OS zero-day, where a patch arrived as a federal deadline approached.

What is still unknown

Several basic facts remain open, and the reporting does not settle them:

• The number of victims and compromised appliances is not public in the sources reviewed.
• Most outlets date the disclosure to October 15, the date of advisory BT26-05, but at least one aggregator reports October 16.
• The sources reviewed did not confirm whether CISA has added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog. One secondary site claims it has, and this desk could not verify that claim.
• The identity of the other vendor hit in the late-September campaign is not stated in the sources reviewed.
• Whether the Privileged Remote Access product was ever exploited remains unresolved.

This week also brought a separate Ivanti Connect Secure chain, CVE-2026-104935. It is a different flaw with its own federal deadline, which falls on October 16, and it should not be confused with the BeyondTrust bug.

What to watch next

Three developments will show how serious this campaign is. The first is whether CISA lists CVE-2026-102764 in its catalog and sets a remediation deadline for federal agencies. The second is whether Mandiant or GTIG publishes victim counts or new indicators of compromise. The third is whether anyone demonstrates exploitation of the Privileged Remote Access product.

Self-hosted operators who waited for the October 8 release should treat patching as the start of a review, not the end of one. The number to watch is the gap between first exploitation and public patch, which in this case ran about seven weeks.