BeyondTrust patches zero-day exploited by Chinese spies for root access

Mandiant and Google Threat Intelligence Group confirmed that the Chinese-linked espionage group ARMORY CASTLE exploited a critical zero-day in BeyondTrust Remote Support software. The attackers used this vulnerability to gain root-level control and access credential vaults starting in late August, as previously reported by Threat Times.

The flaw, identified as CVE-2026-102764, carries a CVSS 4.0 score of 9.3. An unauthenticated attacker can leverage it to perform file operations, resulting in complete host-level control. This access allows the adversary to retrieve every credential the appliance stores or brokers, according to the joint report from Mandiant and GTIG.

Exploitation Timeline and Details

ARMORY CASTLE, formerly tracked as UNC5221, began exploiting the vulnerability on August 29 against both self-hosted and BeyondTrust-hosted instances. The group deployed a PHP web shell called SAWFLY within 11 minutes of the initial malicious request. To escalate privileges, the actor copied system binaries and set SUID bits to achieve root ownership.

BeyondTrust detected the intrusion on September 28 after another vendor’s edge appliances were reported as compromised. The company contained the hosted instance 27 minutes after identification. However, automated triage tools initially closed high-severity alerts as false positives, delaying detection.

Affected Versions and Impact

BeyondTrust issued advisory BT26-05 on the same day as the public disclosure. The vendor stated that a patch was released on October 8. The vulnerability affects Remote Support versions up to 26.2.3. Organizations running self-hosted appliances should treat exposed systems as potentially compromised and verify their integrity immediately.

The joint blog post warns that widespread exploitation is likely following this disclosure. Neither BeyondTrust nor the intelligence firms have confirmed whether other customers were compromised. Mandiant noted that the attackers established footholds for lateral movement after gaining initial access.

What should you do?

Organizations must verify if they are running affected versions of BeyondTrust Remote Support. Self-hosted customers should apply the October 8 patch immediately. Administrators should review logs for anomalies such as unexpected file changes or new web shells.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: BeyondTrust

• Inventory all instances of BeyondTrust Remote Support to check for versions up to 26.2.3.
• Apply the patch released on October 8 to all self-hosted and hosted appliances immediately.
• Monitor system logs for the creation of unexpected files or changes to system binaries.
• Review authentication logs for unauthenticated access attempts or privilege escalation events.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102764?

The CVE record lists a CVSS 4.0 score of 9.3 for this vulnerability.

Which threat actor exploited this flaw?

Mandiant and Google attribute the exploitation to ARMORY CASTLE, a suspected PRC-nexus group.

When was the patch released?

BeyondTrust released a patch on October 8, according to its advisory BT26-05.