Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

1. Executive summary

A group tracked as Armory Castle (also UNC5221, previously Warp Panda) exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day on 29 August 2026, escalating privileges, moving laterally, and harvesting every credential the appliance stored. The flaw is improper origin validation in an internal messaging component, rated CVSS 9.3. BeyondTrust, Mandiant and Google Threat Intelligence Group confirmed the activity and a patch is available. The attribution to a Chinese state-sponsored espionage operation is asserted by BeyondTrust and Mandiant but the actor has no MITRE ATT&CK profile in our reference data, so we treat it as unconfirmed. Any internet-reachable Remote Support appliance that was unpatched before the fix should be treated as compromised until reviewed, and Google assesses widespread opportunistic exploitation is likely now that the flaw is public.

2. Regulatory framing

No other article in the reference is directly engaged by the facts here.

3. Technical analysis & attack chain

Confirmed steps, from BeyondTrust, Mandiant and GTIG reporting:

1. The attacker reached an internet-facing BeyondTrust Remote Support appliance and exploited CVE-2026-102764, an improper origin validation flaw in an internal messaging component, to gain initial access. Exploitation was observed on 29 August 2026.
2. After the initial access the attacker escalated privileges on the appliance.
3. The attacker moved laterally within the victim network and established a deeper foothold.
4. The attacker recovered every credential the appliance stored.
5. The attacker modified files on the appliance in a way that survives reboots and configuration resets.
6. The attacker deployed custom malware, which Mandiant names Sawfly and Bareclaw, and deleted logs and artifacts.

The vulnerability is CVE-2026-102764, CVSS 9.3, improper origin validation in an internal messaging component of BeyondTrust Remote Support (formerly Bomgar). The affected product is the Remote Support appliance that IT teams use to reach and troubleshoot remote endpoints. BeyondTrust has released a patch and states several mitigations are available. The source does not give the affected version range, the patched version number, or the specific mitigations, so we cannot state them here; obtain them from the BeyondTrust advisory before acting.

Mandiant's assessment is that the group had a deep understanding of BeyondTrust appliance internals, evidenced by its use of proprietary tools rather than commodity ones. The two named implants, Sawfly and Bareclaw, are described only by name in the source material; no capabilities, hashes, filenames or command-and-control detail are provided, so we cannot characterise them further.

The persistence detail matters more than the initial access. Files that survive a reboot and a configuration reset mean that power-cycling the appliance or restoring configuration does not evict the attacker. Combined with the credential theft, the practical consequence is that every secret the appliance held, including credentials it brokers to downstream systems, should be considered exposed.

Timeline and discovery: BeyondTrust was first alerted on 27 September 2026 when an attack against another vendor's edge appliances became public, which prompted an internal investigation. Mandiant separately warned BeyondTrust of a potential vulnerability. That hunt led back to the zero-day exploited on 29 August 2026.

Attribution and intent, with caveats. BeyondTrust and Mandiant both attribute the activity to a Chinese state-sponsored espionage operation focused on long-term intelligence collection, and Google's GTIG corroborates the actor. The actor has no MITRE ATT&CK profile in our reference data, so the state-sponsorship attribution is unconfirmed by our own sources and should be treated as vendor assessment, not established fact. BeyondTrust lists documented targets as legal services, SaaS providers, business-process outsourcers, technology companies and government, and states researchers believe the group targets technology firms partly to help discover further zero-days. The group has been active since October 2023. Google assesses that the actor typically exploits a flaw selectively as a zero-day against chosen targets, then moves to broad exploitation of every unpatched instance once the vulnerability is public, and that widespread exploitation attempts against CVE-2026-102764 are possible. Google compares this to the actor's prior widespread exploitation of Ivanti bugs after disclosure. The actor was previously implicated in exploiting zero-days in Citrix and Ivanti products, including CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282. In 2025 Mandiant reported the actor took an Ivanti patch for a flaw rated low risk, studied it, and turned it into working remote code execution against unpatched appliances.

Single-source caveats: the Sawfly and Bareclaw implant names, the credential-theft and reboot-surviving-file claims, and the appliance-internals assessment all rest on Mandiant reporting as relayed by the sources here. Treat them as single-sourced until corroborated by your own appliance forensics or by the vendor's incident report.

4. Mitigation & containment

P1 within 24 hours

• Inventory every BeyondTrust Remote Support appliance, including any that were internet-reachable at any point since 29 August 2026. Mandiant's position is that any vulnerable appliance reachable from the internet should be treated as potentially compromised until reviewed.
• Apply the BeyondTrust patch for CVE-2026-102764. The source does not give the patched version number; take it from the vendor advisory.
• Where the patch cannot be applied immediately, apply the vendor's stated mitigations and remove the appliance from direct internet exposure.
• Treat every credential the appliance stored or brokers as compromised. Rotate those credentials, and rotate any downstream secret reachable with them, after the appliance is confirmed clean. Rotating before remediation risks the attacker re-collecting the new secrets.
• Because the attacker modified files that survive reboots and configuration resets, do not treat a reboot or a configuration restore as remediation. Rebuild the appliance from a known-good image and re-patch, or follow the vendor's remediation guidance if it specifies a different procedure.
• Preserve appliance logs and disk images before rebuilding. The attacker deleted logs and artifacts, so on-appliance evidence may be incomplete; capture what remains and pull any forwarded logs from your SIEM.

P2 within 72 hours

• Hunt for lateral movement and credential use originating from the appliance's network segment, focusing on authentication events using credentials the appliance held.
• Review the appliance's outbound network activity for the period from 29 August 2026 onward for command-and-control or exfiltration patterns. No network indicators are available in the source material, so this is behavioural hunting, not signature matching.
• Check for the Sawfly and Bareclaw implants by name in your EDR telemetry. No hashes or filenames are available, so this is a name-based search only and will miss renamed variants.

P3 within 7 days

• Review your remote-support and privileged-access architecture for internet-exposed appliances that broker credentials to internal systems, and reduce that exposure where the business case allows.
• Confirm your third-party incident-notification path with BeyondTrust so you receive future advisories for this product directly rather than through press reporting.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths, registry keys) are present in the source material. The sources describe behaviours and named tooling only.

Behavioural indicators:

No copyable atomic indicator block is provided because the sources contain no machine-pivotable atomic indicators.

6. Detection

The sources give no file hashes, command-line flags, mutex names, scheduled-task names, registry keys or hard-coded values. The only threat-specific artefacts are the two implant names, which are actor-assigned labels rather than strings that appear in the malware, and a set of behaviours. A YARA rule built on the implant names would detect reporting about the threat, not the threat, so we do not emit one. A Sigma rule can be written against the behavioural pattern that is observable in logs: authentication to downstream systems using appliance-held credentials from unexpected source hosts, following appliance access.

title: Authentication using BeyondTrust Remote Support appliance-held credentials from unexpected source
id: 8f2c1a44-7b6e-4d21-9c3a-0e5d9b7a1c62
status: experimental
description: Detects authentication events to downstream systems using credentials brokered by a BeyondTrust Remote Support appliance, where the source host is not the appliance itself. Relevant to CVE-2026-102764 credential theft.
author: Adverse Trace
date: 2026-10-16
references:

  - https://therecord.media/beyond-trust-cyberattack-china
  - https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType:

      - 3
      - 10
  filter_known_appliance:
    WorkstationName|contains:

      - 'BT-RS-'
      - 'BOMGAR'
  condition: selection and not filter_known_appliance
falsepositives:

  - Legitimate administrative sessions from jump hosts that reuse appliance-brokered credentials
  - Appliance hostname conventions that do not match the filter values above
level: medium

The filter values above are placeholders for your own appliance naming convention; replace them with the hostnames your Remote Support appliances actually use. The rule is a hunting aid, not a signature, because the source material does not give the attacker's actual source hosts or credential names.

7. Sources

• The Record, "Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day", https://therecord.media/beyond-trust-cyberattack-china, 2026-10-16
• SecurityWeek, "Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day", https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/, 2026-10-16
• The Hacker News, "China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers", https://thehackernews.com/2026/10/china-linked-hackers-exploited.html, 2026-10-16

8. Adverse Trace position

CVE-2026-102764 is CVSS 9.3 and is confirmed exploited as a zero-day, so we rate this P1 for any client with an internet-reachable BeyondTrust Remote Support appliance that was unpatched before the fix. The credential-theft and reboot-surviving-file findings mean the blast radius extends past the appliance to every system whose credentials it held, and Google's assessment that the actor moves to broad exploitation once a flaw is public raises the likelihood of follow-on attempts against unpatched instances. The Chinese state-sponsorship attribution is vendor assessment and the actor has no MITRE ATT&CK profile in our reference data, so we do not treat it as established. We will pull the BeyondTrust advisory for the affected version range, patched version and specific mitigations, since the sources here omit all three, and we will issue a follow-up if Mandiant or GTIG publish implant hashes or network indicators. Clients who cannot confirm the patch state of an internet-reachable appliance should contact us before rotating credentials, so the rotation is sequenced after remediation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.