A Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state-sponsored espionage operations.
The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation of message origins that could allow attackers to perform file operations on Remote Support (RS) appliances.
According to BeyondTrust, all RS versions up to and including 26.2.3 are affected. Fixes for the bug were included in the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Customers on releases older than 24.3.1 should upgrade to a newer version and then apply the patch.
BeyondTrust identified the security defect on September 28, one day after its exploitation against a security device provider became public. However, initial exploitation occurred on August 29, against one BeyondTrust-hosted and one self-hosted RS appliance.
The company says it produced a patch by September 30, but took its time to test it and resolve additional exploitation paths before shipping the fix on October 8.
“As of Oct 9, 2026, a patch that remediates this vulnerability has been applied to all Remote Support SaaS customers,” BeyondTrust says, noting that self-hosted customers should manually apply the fix if they do not have automatic updates.
According to Mandiant and Google Threat Intelligence Group (GTIG), CVE-2026-102764 has been exploited as a zero-day by Armory Castle, a China-linked threat actor also tracked as UNC5221 and Warp Panda.
Armory Castle is a state-sponsored espionage group focused on long-term intelligence gathering and is known for targeting SaaS providers, tech companies, government entities, legal services, and business-process outsourcers.
Mandiant and GTIG observed the APT targeting a BeyondTrust device for initial access, deploying the Sawfly webshell and Bareclaw tunneler for interaction with the device, escalating privileges, and moving laterally within the compromised environment.
Sawfly, a lightweight PHP webshell that features bidirectional encrypted command-and-control (C&C) communication capabilities, is the threat actor’s primary foothold within the environment.
After deploying the webshell, Armory Castle gained root-level control of the appliance host, harvested credentials, gained passwordless root privileges to the site service account, and systematically deleted system, web server, and application-level logs.
Next, the attackers pivoted to the RS application using compromised administrator credentials, modified the account’s permissions to gain control of remote systems, and started targeting internal endpoints.
“The threat actor leveraged the appliance’s built-in support tools to request and obtain full file-system access. The threat actor utilized the native BeyondTrust Remote Support file transfer service to download and exfiltrate sensitive internal documents useful for network reconnaissance, such as software inventories, directly from the user’s desktop environment,” Mandiant and GTIG explain.
Additionally, the threat actor was observed using the custom SOCKS5 proxy tunneler Bareclaw, which supports data encryption, traffic chaining to an upstream proxy, and authentication, among others.
“GTIG has previously reported Armory Castle exploiting multiple vulnerabilities in edge appliances and deploying an extensive suite of custom tooling to support their objectives, ranging from passive backdoors and webshells to trojanized components of edge devices. Armory Castle has been active as early as October 2023 and has targeted a wide range of countries and verticals during their operations,” Mandiant and GTIG note.
The threat actor was previously seen exploiting zero-days in Citrix NetScaler (CVE-2023-4966, aka CitrixBleed), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282), and Dell RecoverPoint for Virtual Machines (CVE-2026-22769).
Related: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Related: US Disrupts Chinese State-Sponsored Hacking Tools
Related: Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Related: Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
