BeyondTrust has told customers that a suspected China-nexus group exploited a previously unknown flaw in its Remote Support appliance for weeks before the company found it. The vulnerability, tracked as CVE-2026-102764, lets a remote attacker perform file operations on the appliance, and Google says mass exploitation is likely now that the bug is public.
CVE-2026-102764 Gives Remote Attackers File Access on Remote Support Appliances
BeyondTrust alerted customers on October 15 to the flaw, an improper origin validation weakness in an internal messaging component of Remote Support, formerly known as Bomgar. Self-hosted versions up to and including 26.2.3 are affected. The vulnerability carries a CVSS v4.0 score of 9.3, and one tracker also lists a 9.1 rating under CVSS v3.1. One account of the flaw characterizes it as an authentication bypass that allows unprivileged remote attackers to carry out file operations.
Mandiant and Google Threat Intelligence Group (GTIG) attribute the zero-day exploitation to Armory Castle, a suspected China-nexus group formerly tracked as UNC5221 and known to CrowdStrike as Warp Panda. BeyondTrust’s own timeline says the group exploited one self-hosted appliance on August 29. No public proof-of-concept exists.
How BeyondTrust Found the Intrusion After Another Edge Vendor Was Hit
The discovery came from outside the company’s own telemetry. On September 27, successful exploitation of another security device provider became public, which prompted BeyondTrust to hunt for comparable activity in its own products. That search led to the compromised appliance and the underlying flaw. BeyondTrust patched its Remote Support and Privileged Remote Access SaaS tenants on October 8 or 9, depending on the source, before publishing advisory BT26-05 and the CVE.
SAWFLY Web Shell and BARECLAW Tunneler Gave the Actor Root and Persistence
Once inside, the actor staged a lightweight PHP web shell called SAWFLY, saved as mangoapi.php. The shell communicates with its command-and-control server using Base32 encoding and RC4 encryption, and it returns a 404 error unless a specific parameter is supplied, which helps it avoid casual discovery.
Root Escalation and Credential Theft With the Appliance’s Own Utility
The attacker escalated to root by copying /bin/sh to /usr/bin/dbus-authd and setting the SUID bit on the copy. It then dumped stored passwords and API keys using bt-secrets, a utility that ships with the appliance. Because a Remote Support appliance brokers access to other systems, those stored secrets give an intruder a direct route to downstream infrastructure.
Reboot-Proof Persistence and a WebSocket SOCKS5 Tunnel
Persistence survived reboots. A startup script appended passwordless sudo rights to the sudoers template, so the elevated access was restored each time the appliance restarted. The actor also deployed BARECLAW, a SOCKS5 tunneler carried over WebSockets and routed through the appliance’s haproxy configuration. After that, it wiped system, web and secrets logs, used stolen administrator credentials to move to downstream systems, and exfiltrated IT documents.
Mandiant reports that the operators hid behind commercial VPN exit nodes and compromised home and small-office routers. BeyondTrust’s working assessment is that the actor maintains a model of its target products in an AI context in order to develop exploit chains, though the company presented that as an assessment rather than a confirmed finding.
Exposure: 1,400 Internet-Facing Instances and a Customer Base of 20,000
Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed to the internet. The scan data does not show how many are patched or how many are honeypots. BeyondTrust has more than 20,000 customers, including 75 percent of the Fortune 100.
Armory Castle has a history with edge products. The group has used zero-days in Citrix NetScaler and Ivanti Connect Secure since October 2023, and it typically moves to broad exploitation once a bug becomes public. GTIG advises that any internet-reachable vulnerable appliance should be treated as potentially compromised.
Patch BT26-05-RS and Rebuild Compromised Appliances
Self-hosted customers on version 24.3.1 or later must apply patch BT26-05-RS through the appliance’s /appliance interface. Customers on older versions need to upgrade first. For appliances that may already be compromised, the guidance calls for snapshotting memory and disk, isolating the device at the network perimeter and rebuilding it rather than cleaning it in place.
The intrusion method also bears on what incident responders can recover. Because the actor wiped system, web and secrets logs, victims may have limited local evidence of what was taken, and the stolen credentials and API keys could remain usable on other systems until they are rotated.
