BeyondTrust zero-day gave suspected Chinese spies root access to support appliances
Mandiant says the suspected China-linked group Armory Castle exploited a flaw in BeyondTrust Remote Support from 29 August, before the company disclosed it on 15 October. The attackers gained root access, deployed malware, attempted to retrieve credentials and used compromised accounts to reach internal systems; BeyondTrust says all Remote Support SaaS customers were patched by 9 October, while self-hosted customers must apply the fix themselves.
Bottom line — Mandiant advises treating internet-exposed appliances that ran vulnerable versions as potentially compromised, even after patching.
Go deeper 6
-
The flaw, CVE-2026-102764, affects Remote Support versions up to and including 26.2.3, according to BeyondTrust.
-
Mandiant found the attackers deployed the SAWFLY web shell and BARECLAW tunneller, then erased system, web and application logs.
-
The attackers used BeyondTrust’s support tools to access internal systems and transfer documents, including software inventories, Mandiant reports.
-
BeyondTrust released a precautionary patch for Privileged Remote Access because it shares code with Remote Support; the company said it had not identified a way to exploit the flaw in PRA.
-
BeyondTrust says self-hosted installations need manual patching if automatic updates are disabled. Versions older than 24.3.1 must first be upgraded to a supported release, Mandiant says.
-
Mandiant recommends investigating exposed appliances and rebuilding them from a clean, patched image if compromise is confirmed or cannot be ruled out.