CVE-2026-102764 — an improper-origin validation flaw in BeyondTrust Remote Support rated CVSS 9.3 — was used as a zero-day by the China-nexus group Armory Castle on August 29, 2026, to take over at least one self-hosted remote support appliance.
The vulnerability and vendor response
BeyondTrust described the bug as “within internal components of Remote Support” where “the components did not adequately validate the origin of the messages it received.” Under some conditions, that weakness could be “used to perform file operations on the appliance.” The flaw is tracked as CVE-2026-102764.
BeyondTrust pushed patches to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers running versions from 24.3.1 through 26.2.3 were instructed to manually update to the BT26-05-RS patch; customers on versions older than 24.3.1 must first upgrade to a supported release to receive the fix.
Armory Castle’s exploitation timeline and targeting
BeyondTrust’s internal timeline places a selective zero‑day attack by Armory Castle against a single self-hosted Remote Support appliance on August 29, 2026. The vendor began a wider hunt after “successful exploitation of another security device provider [became] public” on September 27, 2026.
BeyondTrust said the actor “uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched.” The vendor added that its “working assessment is that this actor selects high-value software targets in advance and keeps a working model of the products the actor targets in an AI context that it uses on an ongoing basis to develop exploit chains.”
BeyondTrust and Mandiant link Armory Castle to a history of exploiting high‑value appliance vulnerabilities, including Citrix NetScaler (CVE-2023-4966) and multiple Ivanti Connect Secure flaws (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282). The group has been active since October 2023 and has targeted sectors such as legal services, SaaS providers, business‑process outsourcers, technology firms, and governments for long‑term intelligence collection.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePost-compromise tools and techniques: SAWFLY and BARECLAW
Google-owned Mandiant reported that successful compromises were followed by deployment of a lightweight PHP web shell dubbed SAWFLY, used for interactive access and bidirectional encrypted command‑and‑control. Operators blended their traffic through commercial VPN exit nodes and compromised home and small‑office routers before using the web shell to escalate privileges, gain full administrative control, and establish persistence that survived reboots.
Mandiant and BeyondTrust detailed a set of consistent post‑exploitation behaviors. The actor:
- Gained root‑level control of the appliance host by copying /bin/sh to /usr/bin/dbus-authd, changing ownership to root and enabling SUID so it executed with root privileges.
- Attempted to harvest credentials from the appliance’s native secrets management database using the proprietary /ns/sbin/bt-secrets CLI utility.
- Sought BeyondTrust configuration templates to obtain passwordless root privileges to the site service account.
- Pivoted into the Remote Support application using compromised administrator credentials to launch remote sessions to downstream systems listed in the appliance’s Jump Item list.
- Abused administrative privileges to establish remote support sessions to internal endpoints and obtain full file‑system access aimed at downloading and exfiltrating sensitive documents.
- Tunneled traffic through the appliance using BARECLAW, a C‑based custom SOCKS5 proxy, and modified /ns/config/haproxy.conf so BARECLAW was reachable from the internet.
- Sought to hinder detection by systematically deleting system, web server, and application logs.
What this means for technologists, procurement leaders, and affected enterprises
Technologists responsible for Remote Support appliances should treat “any appliance that was reachable from the internet on a vulnerable version during the exploitation window” as potentially compromised until reviewed, per BeyondTrust. That review should include searching for SAWFLY web shells, evidence of BARECLAW SOCKS5 tunnelers, unexpected /usr/bin/dbus-authd SUID binaries, changes to /ns/config/haproxy.conf, and use of the /ns/sbin/bt-secrets utility.
Procurement leaders and vendor risk teams will need to note the timeline: BeyondTrust issued SaaS patches by October 9, 2026, but self-hosted customers required a manual BT26-05-RS update or an upgrade path for older versions. The vendor’s account of selective zero‑day use and rapid subsequent broad exploitation underscores the importance of patchability and clear update pathways for appliances exposed to the internet.
Affected enterprises should assume that administrative compromise of a Remote Support appliance can enable access to downstream systems via the Jump Item list, remote support sessions with full file‑system access, and credential theft from appliance-managed secrets — all actions Armory Castle executed or attempted in the incidents reviewed by BeyondTrust and Mandiant.
BeyondTrust and Mandiant’s joint picture is stark: an adversary with intimate knowledge of appliance internals, bespoke tooling, and a playbook for persistence can convert a single zero‑day into long‑term access across customer environments. The vendor’s assessment that the actor keeps working models of targeted products “in an AI context” suggests an adversary refining offensive chains as public disclosures appear — a reminder that internet‑reachable management appliances remain high‑value targets until they are patched and reviewed.
https://thehackernews.com/2026/10/china-linked-hackers-exploited.html
