A suspected China-nexus espionage group exploited a critical vulnerability in BeyondTrust Remote Support as a zero-day, gaining access to an appliance and deploying custom malware, according to Google Threat Intelligence. The campaign, attributed to the actor tracked as Armory Castle, began in late August before BeyondTrust disclosed the flaw on Oct. 15.
The vulnerability, CVE-2026-102764, is an improper origin-validation issue in internal Remote Support messaging components. Under the right conditions, an unauthenticated remote attacker can spoof a trusted entity and perform file operations on the appliance, potentially leading to host-level control and access to credentials stored or brokered by the system. The CVE record assigns the flaw a CVSS 4.0 score of 9.3, rated critical, and classifies it as CWE-290, authentication bypass by spoofing. No CVSS v3 score is listed in the current CVE record. [1]
All supported BeyondTrust Remote Support versions through and including 26.2.3 are affected. BeyondTrust’s BT26-05-RS fix covers self-hosted versions 24.3.1 through 26.2.3; customers running older releases must upgrade to a supported version before applying the patch. BeyondTrust said patches had been applied to Remote Support SaaS customers by Oct. 9, while self-hosted administrators must verify automatic updates or apply the fix through the appliance interface. Google Threat Intelligence’s incident report provides the vendor remediation guidance. [16]
Google researchers said Armory Castle, previously tracked as UNC5221, used the compromise to install SAWFLY, an obfuscated PHP webshell, and BARECLAW, a SOCKS5 tunneling tool that communicates over WebSockets. The activity also included file manipulation and the removal of logs and other artifacts, actions intended to conceal the intrusion and preserve access. The attribution remains a threat-intelligence assessment rather than a public identification of an operator.
The incident is especially consequential because Remote Support appliances can provide privileged access to enterprise endpoints and broker sensitive credentials. Organizations should treat internet-reachable appliances that were exposed while vulnerable as potentially compromised, not merely unpatched: apply BT26-05-RS or upgrade and patch, preserve relevant evidence, investigate for unauthorized files and webshells, and rotate credentials only after the appliance has been remediated or rebuilt. CISA describes its Known Exploited Vulnerabilities catalog as an authoritative source for vulnerabilities confirmed exploited in the wild; defenders should check the catalog as it is updated and prioritize this flaw accordingly. [19]
References
- CVE Record: CVE-2026-102764
- Zero-day Vulnerability Database
- Known Exploited Vulnerabilities: Live CISA KEV Catalog … – Senserva
