1. Executive summary
A zero-day in BeyondTrust Remote Support appliances, tracked as CVE-2026-102764, was exploited in espionage intrusions before a patch existed, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-10-19. Mandiant and Google Threat Intelligence Group attribute the activity to a suspected Chinese state-sponsored group they call Armory Castle or UNC5221, which used custom malware named Sawfly and Bareclaw, escalated privileges, moved laterally, and extracted every credential stored on the appliance. BeyondTrust, Mandiant and GTIG confirmed the vulnerability and a patch is available, but Mandiant's position is that any internet-reachable appliance must be treated as potentially compromised until reviewed. For EMEA financial services, the exposure is concentrated in remote-support and privileged-access infrastructure that sits on the edge of the network and often holds credentials to everything behind it; the CISA due date of 2026-10-19 leaves two days from issue.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Mandiant assesses that any internet-reachable BeyondTrust appliance should be treated as potentially compromised until reviewed, and the actor extracted all credentials the appliance stored and modified files that survive reboots and configuration resets | If a client's Remote Support appliance was internet-reachable during the exploitation window, the incident may meet the major-incident threshold and require reporting to the competent authority; the persistence that survives resets makes "we rebuilt it" an unreliable closure criterion |
| DORA Art. 28: ICT third-party risk — general principles | The compromised component is a third-party remote-support and privileged-access product, and the actor's access to it is access to the client's own estate | Third-party risk assessment must cover the appliance's internet exposure and credential store, not just the vendor's contractual assurances |
| NIS2 Art. 23: incident reporting obligations | Same trigger as Art. 19: a potentially compromised edge appliance holding estate-wide credentials | Entities in scope must assess whether the incident meets national reporting thresholds and file within the applicable window |
3. Technical analysis & attack chain
The vulnerability is an authentication bypass by spoofing in BeyondTrust Remote Support that allows a remote attacker to perform file operations on the appliance. GitHub's advisory describes a related pre-authentication flaw in the network communication subsystem where insufficient validation of client-supplied input can trigger a denial-of-service condition affecting appliance availability; the two descriptions may cover the same code path or adjacent ones, and the CISA KEV entry is the authoritative classification for CVE-2026-102764. No CVSS score, CWE identifier or EPSS value is available for this CVE.
Confirmed sequence, from BeyondTrust, Mandiant and GTIG:
- The actor exploited CVE-2026-102764 against internet-reachable Remote Support appliances. Mandiant traced exploitation to August 29.
- After exploiting the bug, the actor escalated privileges on the appliance.
- The actor moved laterally within the victim network and established a deeper foothold.
- The actor extracted every credential the appliance stored.
- The actor modified files that survive reboots and configuration resets.
BeyondTrust was first tipped off on September 27, when an attack against another vendor's edge appliances became public and prompted an investigation into a similar issue. Mandiant separately warned BeyondTrust of a potential vulnerability, which sent the vendor's engineering team looking and led them back to the zero-day exploited on August 29. A patch has been released and several mitigations are available.
The actor's tooling is the part that matters for detection. Mandiant observed custom malware it calls Sawfly and Bareclaw, and assessed that the group had a deep understanding of BeyondTrust appliance internals based on its abuse of proprietary tools. BeyondTrust confirmed Mandiant's assessment that Armory Castle is a Chinese state-sponsored espionage operation focused on long-term intelligence collection. Documented targets include legal services, SaaS providers, business-process outsourcers, technology companies and government. The group has been active since October 2023.
Google's assessment is that the actor uses a zero-day selectively against chosen targets and, once the vulnerability is public, typically moves to broad exploitation of every instance still unpatched. Google compared the situation to the actor's widespread exploitation of Ivanti bugs after disclosure and said it is possible similar widespread exploitation attempts will follow for CVE-2026-102764. BeyondTrust cited a 2025 Mandiant finding in which the actor took an Ivanti patch for a flaw rated low risk, studied it, and turned it into working remote code execution against unpatched appliances. The actor has previously been implicated in exploiting zero-days in Citrix and Ivanti products, including CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
Confidence caveats. The attribution to a Chinese state-sponsored group rests on Mandiant, GTIG and BeyondTrust statements reported by The Record; no MITRE ATT&CK profile for Armory Castle or UNC5221 is available to this advisory, so the attribution is unconfirmed here and should be treated as vendor assessment rather than established fact. The malware names Sawfly and Bareclaw, and the specific capabilities attributed to them, are single-sourced to Mandiant's incident response reporting. No atomic indicators (hashes, domains, IP addresses, file paths) were published in the material available to this advisory, so no enforcement-grade IOC set can be issued.
4. Mitigation & containment
P1, within 24 hours:
- Inventory every BeyondTrust Remote Support and Privileged Remote Access appliance, and determine which were reachable from the internet between August 29 and patch deployment. Mandiant's position is that any such appliance must be treated as potentially compromised until reviewed.
- Apply the vendor patch. CISA's required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 and CISA's Forensics Triage Requirements, and to follow BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-10-19.
- Where the patch cannot be applied immediately, take the appliance off the internet and apply the vendor's published mitigations. Do not rely on network position alone: the flaw is pre-authentication.
- Rotate every credential the appliance stores, plus any credential the appliance could reach. The actor extracted the full credential store, so assume all of it is in adversary hands. Rotation must include credentials used for the appliance's own administrative access and any downstream systems it authenticates to.
- Do not treat a rebuild or configuration reset as remediation on its own. The actor modified files that survive reboots and configuration resets, so a reset returns the appliance to a still-compromised state.
P2, within 72 hours:
- Hunt for lateral movement originating from the appliance, using the appliance's own authentication and session logs as the starting point. Mandiant observed privilege escalation on the appliance followed by lateral movement and a deeper foothold.
- Review the appliance's file system for modification outside the vendor's expected baseline, with particular attention to files that persist across reboots and resets.
- If compromise is confirmed or cannot be excluded, engage an incident response retainer with appliance-level forensic capability. The actor's use of proprietary tooling against appliance internals means generic host forensics may not surface it.
P3, within 7 days:
- Add the appliance's management interfaces to the external attack-surface inventory and require a documented business justification for any internet exposure.
- Review third-party risk records for the appliance against DORA Art. 28 expectations, covering internet exposure, credential store scope and vendor notification timelines.
- Prepare the incident-reporting assessment under DORA Art. 19 and NIS2 Art. 23 in parallel with the technical work, since the reporting clock does not wait for forensic certainty.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe behaviours but publish no atomic indicators. The behavioural indicators below are drawn from Mandiant, GTIG and BeyondTrust reporting as relayed by The Record, and are single-sourced to those vendors.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Exploitation of CVE-2026-102764 against an internet-reachable Remote Support appliance | Appliance network communication subsystem logs; external exposure inventory | High (confirmed by vendor and CISA KEV) |
| Privilege escalation on the appliance following exploitation | Appliance authentication and audit logs | Medium (Mandiant incident response, single-sourced) |
| Lateral movement from the appliance into the internal network | Appliance session logs correlated with internal authentication logs | Medium (Mandiant incident response, single-sourced) |
| Bulk access to the appliance's stored credential set | Appliance credential store access logs | Medium (Mandiant incident response, single-sourced) |
| Modification of files that survive reboots and configuration resets | Appliance file system integrity monitoring against vendor baseline | Medium (Mandiant incident response, single-sourced) |
| Presence of custom malware named Sawfly or Bareclaw | Appliance file system and process telemetry | Low (single-sourced to Mandiant; no hashes or paths published) |
6. Detection
Insufficient indicators to author detection rules.
The sources name two malware families, Sawfly and Bareclaw, but publish no strings, filenames, paths, registry keys, mutexes, command-line flags or network artefacts associated with them. A rule built on the family names or on CVE-2026-102764 would detect reporting about the threat rather than the threat itself, so none is emitted. Detection effort should go to the behavioural indicators in §5 until the vendor or Mandiant publishes atomic artefacts.
7. Sources
- Dark Reading, "BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs", https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs, 2026-10-16
- The Record (Recorded Future), "Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day", https://therecord.media/beyond-trust-cyberattack-china
- GitHub Security Advisories, "BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability...", https://github.com/advisories/GHSA-8v46-5p7g-p46j
- CISA Known Exploited Vulnerabilities, CVE-2026-102764, BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-102764
8. Adverse Trace position
Adverse Trace assesses CVE-2026-102764 as a high-urgency item for any EMEA financial services client running internet-reachable BeyondTrust Remote Support or Privileged Remote Access appliances, on the basis of confirmed exploitation, a CISA KEV due date of 2026-10-19, and Mandiant's assessment that any internet-reachable appliance should be treated as compromised until reviewed. We are not assigning a CVSS score, because none is available for this CVE. The attribution to a Chinese state-sponsored group is a vendor assessment from Mandiant, GTIG and BeyondTrust and is unconfirmed here, as no MITRE ATT&CK profile for Armory Castle or UNC5221 is available to us. The malware names and capabilities are single-sourced to Mandiant and should be verified before any enforcement action. We will track vendor and Mandiant publications for atomic indicators and issue a follow-up if a usable IOC set or a YARA-viable artefact appears; clients who cannot confirm the exposure window for an internet-reachable appliance should contact us before closing the incident.
Published via PulseTrace — Adverse Trace threat intelligence.