Suspected China-nexus actor exploited BeyondTrust Remote Support zero-day from late August
BeyondTrust says a suspected China-nexus actor has exploited Remote Support flaw CVE-2026-102764 since late August. SaaS customers were patched on October 8, but self-hosted installs without automatic updates must be updated by hand.
The Watch · Security desk
Three figures. Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online. Volexity said in January 2024 that UNC5221 backdoored more than 2,100 Ivanti appliances. Silk Typhoon is believed to have compromised 17 Remote Support SaaS instances using a stolen API key.
- over 1,400 instances BeyondTrust instances exposed online, claim 12 Shadowserver; patched share not given
- more than 2,100 appliances Ivanti appliances backdoored by UNC5221, claim 9 per Volexity, January 2024
- 17 instances Reported Remote Support SaaS instances compromised, claim 14 Silk Typhoon believed responsible
| Figure | Value | Note | Claim |
|---|---|---|---|
| BeyondTrust instances exposed online, over | 1,400 instances | Shadowserver; patched share not given | 12 |
| Ivanti appliances backdoored by UNC5221, more than | 2,100 appliances | per Volexity, January 2024 | 9 |
| Reported Remote Support SaaS instances compromised | 17 instances | Silk Typhoon believed responsible | 14 |
What happened
- The flaw is an authentication bypass that lets unprivileged remote attackers perform file operations on unpatched appliances running Remote Support 26.2.3 or earlier.
- BeyondTrust attributes the attacks to a suspected China-nexus espionage actor that Mandiant and Google Threat Intelligence Group track as Armory Castle, formerly UNC5221, and CrowdStrike calls Warp Panda.
- Mandiant, which spotted the first attacks, says the actor used the bypass for initial access and then gained root by enabling SUID permissions.
- After root, the actor deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved to downstream systems using compromised Administrator credentials.
Why it matters
- What it limits constraint Defenders cannot size the exposed population. Shadowserver tracks over 1,400 BeyondTrust remote support instances online but does not break out how many are patched or are honeypots.
- What it sets up precedent Mandiant says Armory Castle has followed selective zero-day use with widespread, opportunistic exploitation after disclosure, and that a repeat against this flaw is possible.
- Who's exposed exposure Remote Support has drawn ransomware operators exploiting CVE-2026-1731 and Silk Typhoon, a Chinese state-backed group believed to have exploited two earlier BeyondTrust zero-days, so exposed instances attract both criminal and state-backed attackers.
The root step decides how much a victim has to check. Mandiant said: "After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset." [6]
Mandiant's guidance follows from that. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," the firm said. [7] In our view, that gives a self-hosted admin two jobs: update the appliance, then review it and the credentials it brokered. [6] [7]
BeyondTrust shared limited details about the flaw, so the post-exploitation chain rests on Mandiant, which spotted the first attacks. [11] [4]
Armory Castle is known for targeting zero-days in edge appliances, according to BleepingComputer, and has done so since at least October 2023 to breach enterprise networks and drop new custom malware. [8] Its past targets include Ivanti Connect Secure, hit through CVE-2023-46805 and CVE-2024-21887 and later through CVE-2025-0282, and Citrix NetScaler, hit through CVE-2023-4966. [8] The method here is the same: a flaw in an internet-facing appliance, then new tooling in the form of Sawfly and Bareclaw. [5]
Volexity said in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances with the GiftedVisitor webshell, in attacks chaining CVE-2023-46805 and CVE-2024-21887. [9]
What to watch
- Whether Mandiant or other firms report widespread exploitation of CVE-2026-102764 now that the flaw is public, as happened in earlier Armory Castle campaigns.
- Whether BeyondTrust publishes more technical detail on the flaw beyond the limited disclosure so far.
- Whether Shadowserver's count of more than 1,400 exposed instances falls as self-hosted customers update.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence76
Perspective Coverage
8 publishers- Builder
- Builder 16%
- Operator
- Operator 67%
- Investor
- Investor 17%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support product that has been exploited in zero-day attacks since late August.
- [2]
CVE-2026-102764 is an actively exploited authentication bypass that lets unprivileged remote attackers perform file operations on unpatched appliances and affects Remote Support 26.2.3 or earlier.
- [3]
BeyondTrust said the zero-day was abused by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group as Armory Castle (formerly UNC5221) and by CrowdStrike as Warp Panda.
- [4]
According to Mandiant researchers, who spotted the initial attacks, Armory Castle exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions.
- [5]
The actor then deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally using compromised Administrator credentials by opening remote sessions on downstream systems.
- [6]
"After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant said.
- [7]
"Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," in the same Mandiant statement quoted by BleepingComputer.
- [8]
Armory Castle is known for targeting zero-day vulnerabilities in network edge appliances, including Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, then CVE-2025-0282), since at least October 2023, to breach enterprise networks and drop new custom malware.
- [9]
Volexity said in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining the CVE-2023-46805 and CVE-2024-21887 zero-days.
- [10]
Mandiant said that in past campaigns Armory Castle has conducted widespread and opportunistic exploitation following public disclosure of vulnerabilities it had exploited selectively as zero-days, and that it is possible similar widespread exploitation attempts will be observed for CVE-2026-102764.
- [11]
BeyondTrust shared limited details about the vulnerability.
- [12]
Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online, but it provides no information on how many have already been secured or are honeypots.
- [13]
Attackers recently exploited another critical remote code execution vulnerability, CVE-2026-1731, in Remote Support and Privileged Remote Access appliances to establish WebSocket channels and deploy ransomware.
- [14]
The Chinese state-backed Silk Typhoon group is believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems and use a stolen API key to compromise 17 Remote Support SaaS instances, including the U.S. Treasury Department's.
- [15]
BeyondTrust patched the issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
8 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comBeyondTrust patches zero-day exploited in attacks since August
1 article · October 15, 2026
- cyberscoop.comProlific Chinese espionage group exploits BeyondTrust zero-day
1 article · October 16, 2026
- dev.toArmory Castle Exploited BeyondTrust Remote Support Zero-Day CVE-2026-102764 to Seize Appliances and Pivot Downstream
1 article · October 16, 2026
- infosecurity-magazine.comChina Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
1 article · October 16, 2026
- scworld.comBeyondTrust zero-day exploited by China-linked group Armory Castle
1 article · October 16, 2026
- securityweek.comChinese APT Exploited BeyondTrust Vulnerability as Zero-Day
1 article · October 16, 2026
- thehackernews.comChina-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
1 article · October 15, 2026
- therecord.mediaSuspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Edge and IoT Device SecurityFollow
- Zero-Day VulnerabilitiesFollow
- China-nexus cyber espionageFollow
- Privileged remote accessFollow