Chinese spies exploit BeyondTrust zero-day CVE-2026-102764 for root access
Armory Castle abused a critical flaw in BeyondTrust Remote Support appliances to steal credentials and gain persistent root privileges on victim networks.
Key points
- Mandiant and Google confirm Armory Castle exploited CVE-2026-102764 in August.
- Attackers used the flaw to extract stored credentials and modify system files.
- BeyondTrust confirmed the zero-day and noted a patch has been released.
BeyondTrust, Mandiant, and Google Threat Intelligence Group confirmed on Thursday evening that a Chinese state-backed espionage group is exploiting a zero-day vulnerability in BeyondTrust Remote Support software. The firms published detailed incident reports describing how the attackers used the flaw to conduct long-term intelligence collection operations against targeted organizations.
The vulnerability, identified as CVE-2026-102764, affects appliances designed to help IT teams securely access and troubleshoot remote endpoints. According to BeyondTrust, a patch has been released addressing the issue, and several mitigations are available. Other cybersecurity firms have since confirmed that exploitation of this specific bug is occurring in the wild.
Attack Timeline and Tactics
BeyondTrust stated it first received information about the vulnerability on September 27. This alert came after an attack on another vendor’s edge appliances became public, prompting an investigation into similar issues. Mandiant also warned BeyondTrust of a potential flaw, leading the engineering team to discover that attackers had already exploited a zero-day on August 29.
Mandiant incident responders reported that the attackers escalated privileges after exploiting the bug. They moved laterally within the victim’s network to establish a deeper foothold. The group, identified as Armory Castle or UNC5221, demonstrated a deep understanding of BeyondTrust appliance internals, likely due to their abuse of proprietary tools.
Threat Actor Profile
Mandiant observed the group using custom malware dubbed Sawfly and Bareclaw during these intrusions. The threat actors successfully extracted every credential stored by the appliance. They also modified files that survive reboots and configuration resets, ensuring persistent access even after system changes.
BeyondTrust confirmed Mandiant’s assessment that Armory Castle is a Chinese state-sponsored espionage operation. The group focuses on long-term intelligence collection. Documented targets include legal services, SaaS providers, business-process outsourcers, technology companies, and government entities.
Affected Systems and Scope
Researchers believe the group targets technology firms to aid in the discovery of other zero-day exploits. The group has previously exploited multiple vulnerabilities in popular edge devices. They are known for using passive backdoors and novel tools to sustain access to breached systems over extended periods.
Mandiant warned that any vulnerable appliance reachable from the internet should be treated as potentially compromised. Organizations must review these systems thoroughly. As Threat Times reported on October 16, earlier investigations linked ARMORY CASTLE to similar critical remote support flaws granting full control.
What should you do?
Organizations using BeyondTrust Remote Support appliances should verify their version status immediately against the latest vendor advisory. Check for any unauthorized file modifications or unexpected reboots. Monitor network logs for lateral movement originating from management appliances. Apply the newly released patch as soon as possible to close the vulnerability.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: BeyondTrust
- Verify if your Remote Support appliances are internet-facing and check for signs of compromise such as modified system files.
- Apply the latest vendor patch immediately to address CVE-2026-102764 and close the zero-day vulnerability.
- Rotate all credentials that may have been stored or processed by the affected appliances to prevent unauthorized access.
- Monitor network traffic for unusual lateral movement patterns originating from management endpoints or support tools.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102764?
It is a zero-day vulnerability in BeyondTrust Remote Support software that allows attackers to gain root access and steal credentials.
Who is behind these attacks?
The attackers are identified as Armory Castle (UNC5221), a Chinese state-sponsored espionage group focused on long-term intelligence collection.
Is there a fix available?
Yes, BeyondTrust stated that a patch has been released addressing the issue, along with several mitigation recommendations.
