China-Linked Hackers Used BeyondTrust Zero-Day to Seize Remote Support Servers

The China-nexus cyber espionage crew tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

The bug carries the identifier CVE-2026-102764 and a CVSS score of 9.3. It is a case of improper origin validation in an internal messaging component: according to BeyondTrust, the component failed to adequately verify where the messages it received came from, which under the right conditions let a remote attacker perform file operations on the appliance.

Timeline and fixes

Patches reached all Remote Support SaaS customers by October 9, 2026. Self-hosted users on versions 24.3.1 through 26.2.3 are told to apply the BT26-05-RS update manually, while anyone on a release older than 24.3.1 must first move to a newer version.

Per the company's timeline, Armory Castle hit a single self-hosted appliance as a zero-day on August 29, 2026. The investigation came later: on September 27 a successful compromise of another security-device vendor became public, prompting BeyondTrust to hunt for similar activity.

The group's playbook

Armory Castle has been active since October 2023 and previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure, breaching legal services, SaaS providers, business-process outsourcers, technology firms and governments for long-term intelligence collection. BeyondTrust's working assessment is that the actor picks high-value software targets in advance and keeps a working model of those products in an AI context it uses continuously to build exploit chains. While a flaw stays secret, it is used selectively; once it goes public, the actor switches to broad exploitation of every unpatched instance.

Google-owned Mandiant detailed what follows a breach: a lightweight PHP web shell codenamed SAWFLY is deployed for interactive access and encrypted command-and-control. Traffic is blended into normal flows through commercial VPN exit nodes and compromised home and small-office routers.

The operators then escalated to root — copying the system shell into a SUID-enabled file — harvested passwords and API keys from the built-in secrets database via the proprietary bt-secrets utility, reached downstream systems through the appliance's Jump Item list, and exfiltrated internal documents. A custom C-based SOCKS5 proxy named BARECLAW handled tunneling, and the intruders covered their tracks by deleting system, web-server and application logs.

Researchers stress the attackers' deep grasp of BeyondTrust appliance internals. Any appliance that was internet-reachable on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.

Source: The Hacker News