Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

1. Executive summary

A China-linked espionage group tracked as Armory Castle (also reported as UNC5221 and Warp Panda) exploited CVE-2026-102764 in BeyondTrust Remote Support as a zero-day from 29 August 2026, gaining root on RS appliances, deploying the Sawfly PHP webshell and the Bareclaw SOCKS5 tunneler, harvesting credentials, and deleting system, web server and application logs. The flaw is rated CVSS 9.3 (critical) and is not listed in CISA KEV as of this advisory. All Remote Support versions up to and including 26.2.3 are affected; BeyondTrust shipped the BT26-05-RS patch on 8 October 2026 and states the fix was applied to all SaaS customers by 9 October, leaving self-hosted appliances dependent on manual patching. EMEA financial services firms running self-hosted RS appliances, or whose outsourced service providers do, should treat any unpatched instance as compromised rather than merely vulnerable, because the actor's post-exploitation behaviour includes log destruction that defeats retrospective forensic scoping.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-102764 is an improper validation of message origins (CWE-290, authentication bypass by spoofing) in an internal messaging component of BeyondTrust Remote Support, formerly Bomgar. Successful exploitation allows file operations on the RS appliance. The verified reference data records CVSS 9.3 critical and CWE-290; BeyondTrust's own description of the flaw as "improper validation of message origins" is consistent with that classification.

Confirmed attack chain, drawn from Mandiant and Google Threat Intelligence Group reporting as relayed by The Hacker News and SecurityWeek:

1. Initial access against a BeyondTrust Remote Support appliance via CVE-2026-102764, exploited as a zero-day. The first two confirmed victims were one BeyondTrust-hosted appliance and one self-hosted appliance, both on 29 August 2026.
2. Deployment of Sawfly, a lightweight PHP webshell providing bidirectional encrypted command-and-control. Mandiant and GTIG describe Sawfly as the actor's primary foothold in the environment.
3. Root-level control of the appliance host, followed by credential harvesting.
4. Passwordless root privileges obtained for the site service account.
5. Systematic deletion of system, web server and application-level logs.
6. Pivot to the RS application using compromised administrator credentials, with the account's permissions modified to gain control of remote systems.
7. Use of the appliance's built-in support tools to request and obtain full file-system access.
8. Exfiltration of internal documents through the native BeyondTrust Remote Support file transfer service, taken directly from user desktop environments. Mandiant and GTIG note software inventories were among the material collected for network reconnaissance.
9. Use of Bareclaw, a custom SOCKS5 proxy tunneler supporting data encryption, traffic chaining to an upstream proxy, and authentication.

BeyondTrust identified the defect on 28 September 2026, one day after exploitation against a security device provider became public. A patch was produced by 30 September, held for testing and for resolution of additional exploitation paths, and shipped on 8 October 2026 as BT26-05-RS for versions 24.3.1 through 26.2.3. Customers on releases older than 24.3.1 must upgrade to a newer version first, then apply the patch. BeyondTrust states that as of 9 October 2026 the patch had been applied to all Remote Support SaaS customers, and that self-hosted customers without automatic updates must apply it manually.

Armory Castle has previously been observed exploiting zero-days in Citrix NetScaler (CVE-2023-4966, CitrixBleed), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282) and Dell RecoverPoint for Virtual Machines (CVE-2026-22769). GTIG reports the group active since at least October 2023, targeting SaaS providers, technology companies, government entities, legal services and business-process outsourcers across a wide range of countries.

Confidence caveats. The attribution to Armory Castle rests on Mandiant and GTIG reporting as relayed by the two secondary sources; the verified reference data holds no MITRE ATT&CK profile for Armory Castle, so the attribution is unconfirmed and the aliases UNC5221 and Warp Panda should be treated as vendor-assigned rather than established. The technical detail on Sawfly, Bareclaw, credential harvesting and log deletion is single-sourced to Mandiant and GTIG. No atomic indicators (hashes, domains, IP addresses, file paths) appear in any of the supplied material, so none are reproduced here.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every BeyondTrust Remote Support deployment in the estate and classify each as SaaS or self-hosted. For self-hosted instances, confirm the installed version. Anything at or below 26.2.3 without BT26-05-RS applied is in scope.
• Where the appliance is operated by a managed service provider or outsourcer, obtain written confirmation of patch state and of the date the patch was applied. Do not accept a verbal assurance.
• Treat any unpatched self-hosted RS appliance as potentially compromised. Isolate it from the internal network at the network layer rather than relying on application-level controls, and preserve a disk image before remediation if forensic scoping is required.
• Because the actor deletes system, web server and application logs, pull logs to a remote collector now for any RS appliance that has been internet-facing since 29 August 2026. Local logs on a compromised appliance cannot be relied on.
• Reset credentials for all RS administrator and site service accounts, and audit those accounts for permission changes made since 29 August 2026. The actor modified account permissions to extend control over remote systems.

P2, within 72 hours:

• Apply BT26-05-RS to all self-hosted instances on versions 24.3.1 through 26.2.3. Instances older than 24.3.1 must be upgraded to a supported release first, then patched.
• Review RS file transfer activity and support-session records for outbound transfers of documents from user desktops, particularly software inventories and network documentation.
• Hunt for PHP webshell artefacts on RS appliance hosts and for outbound SOCKS5 proxy traffic consistent with Bareclaw, including chained connections to an upstream proxy.
• Confirm whether the RS appliance has automatic updates enabled. If not, add it to a tracked manual patch process with an owner.

P3, within 7 days:

• Review DORA Art. 28 third-party risk documentation for remote-support tooling and record the patch-state confirmation obtained in P1.
• Where the appliance is provided under contract, check whether the contract obliges the provider to notify the firm of exploited vulnerabilities in the platform, and raise the gap if it does not.
• Add remote-support appliances to the asset inventory used for DORA Art. 29 concentration assessment if they are not already there.

5. Indicators of compromise

No atomic indicators of compromise available in the source material. The sources name tooling and behaviour but give no hashes, domains, IP addresses, file paths, registry keys or command lines.

Behavioural indicators:

6. Detection

The sources give no file hashes, command lines, mutexes, scheduled-task names or registry keys. The named artefacts are the tool names Sawfly and Bareclaw and the product's own file transfer service, none of which are distinctive strings in a file or command line. A YARA rule built on those names would detect reporting about the threat rather than the threat, so none is emitted.

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• SecurityWeek, "Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day", https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/, 2026-10-16
• The Hacker News, "China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers", https://thehackernews.com/2026/10/china-linked-hackers-exploited.html, 2026-10

8. Adverse Trace position

Adverse Trace assesses CVE-2026-102764 at its verified CVSS 9.3 critical, with no CISA KEV listing as of 2026-10-16, and treats the exploitation as confirmed by BeyondTrust's own remediation timeline rather than by vendor attribution alone. The attribution to Armory Castle is unconfirmed: the verified reference data holds no MITRE ATT&CK profile for that actor, and the technical detail on Sawfly, Bareclaw and the log deletion is single-sourced to Mandiant and GTIG, so clients should verify before building enforcement around those names. The material risk to EMEA financial services clients is not the patch itself, which exists, but the combination of a self-hosted appliance that may not have automatic updates, an actor that deletes the logs needed to scope the intrusion, and a remote-support platform that by design holds privileged access to internal endpoints. We will track BeyondTrust advisories for any revision to the affected version range or to the BT26-05-RS patch, and we will issue a follow-up if atomic indicators for Sawfly or Bareclaw are published by a source we can corroborate. Clients who cannot confirm the patch state of a self-hosted RS appliance within 24 hours should contact us to scope a compromise assessment.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.