BeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited by Armory Castle

China-linked cyber espionage group Armory Castle exploited a critical zero-day vulnerability in BeyondTrust Remote Support to breach target networks and gain complete administrative control over remote access appliances. Tracked as CVE-2026-102764, the security flaw carries a CVSS score of 9.3 and stems from an improper origin validation issue in internal messaging components. Initial zero-day exploitation against a self-hosted Remote Support appliance was detected on August 29, 2026, prior to BeyondTrust developing and deploying widespread fixes across October.

The vulnerability allows unauthenticated attackers on adjacent or remote networks to trigger arbitrary file operations on the host appliance without requiring user interaction. While its current EPSS probability score sits at a modest 0.60% (47.6th percentile)—a metric reflecting automated mass-exploitation scanning rather than targeted state-sponsored zero-day operations—the underlying CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights why this flaw is catastrophic in practice. Once an unauthenticated remote connection can abuse improper origin validation (CWE-290) inside an internal messaging handler, the attacker can manipulate appliance file systems directly and pivot to full system takeover.

Deep Appliance Intrusion and Post-Exploitation Mechanics

According to investigation details shared by Google-owned Mandiant and Google Threat Intelligence Group (GTIG)—authored by researchers Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, and John Wolfram—Armory Castle demonstrated surgical familiarity with BeyondTrust Remote Support (formerly Bomgar) internals.

Upon establishing initial entry, the threat actor dropped a lightweight PHP web shell codenamed SAWFLY. This web shell served as the initial conduit for interactive remote execution and bidirectional encrypted command-and-control (C2) communication. To hide traffic, Armory Castle routed connections through commercial VPN exit nodes and compromised small-office/home-office (SOHO) routers.

The post-exploitation workflow involved a sequence of high-privilege abuse techniques:

• Privilege Escalation via SUID Backdoor: The attacker copied the standard system shell executable (/bin/sh) to /usr/bin/dbus-authd, altered the file ownership to root, and set the Set User ID (SUID) bit. This allowed any execution of dbus-authd to spawn a shell with elevated root permissions.
• Credential Harvesting: Armory Castle executed the proprietary Command Line Interface utility /ns/sbin/bt-secrets—a built-in tool for managing appliance secrets—to directly extract stored passwords, API tokens, and downstream endpoint credentials from the local native secrets database.
• Service Account Compromise: The actor modified BeyondTrust configuration templates to grant themselves passwordless root access to the site service account.
• Lateral Movement via Jump Items: Using hijacked administrator credentials, the group logged into the Remote Support web console, launched interactive sessions against internal systems pre-populated in the appliance’s Jump Item list, and exfiltrated sensitive internal documents.
• Persistent Tunneling: To maintain resilient network access, the attacker deployed BARECLAW, a custom C-based SOCKS5 proxy, and altered /ns/config/haproxy.conf to expose the proxy port directly to the public internet.
• Anti-Forensics: Armory Castle systematically purged application logs, web server logs, and Linux system logs to hamper post-incident detection.

Threat Actor Profile: Armory Castle

Armory Castle (previously tracked as UNC5221 or Warp Panda) has been active since at least October 2023, functioning as a China-nexus espionage operation targeting high-value sectors including legal services, technology, government bodies, business-process outsourcers, and SaaS providers.

The adversary’s operating doctrine relies on stockpiling high-impact zero-days in enterprise perimeter and remote-access appliances. BeyondTrust noted that the actor appears to maintain working product models inside an AI context to continuously craft and refine exploit chains against targeted software products. Prior campaigns attributed to Armory Castle include the exploitation of zero-days in Citrix NetScaler (CVE-2023-4966 / CitrixBleed) as well as multiple Ivanti Connect Secure flaws (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282).

Armory Castle historically follows a distinct lifecycle: using a zero-day with extreme precision against select espionage targets, then shifting to aggressive, wide-scale exploitation across all unpatched internet-facing instances the moment the vulnerability details become public.

Patching and Incident Response Guidance

BeyondTrust completed automated hotfix pushes to all Remote Support SaaS customers as of October 9, 2026. However, self-hosted deployments require immediate manual intervention.

• Self-Hosted Versions 24.3.1 through 26.2.3: Administrators must immediately apply the BT26-05-RS patch package referenced in BeyondTrust advisory BT26-05.
• Self-Hosted Versions Older than 24.3.1: Environments on legacy releases must first upgrade to a supported release family (24.3.1 or higher) before applying the BT26-05-RS patch.

Because Armory Castle was actively exploiting CVE-2026-102764 prior to public disclosure, organizations operating internet-facing self-hosted Remote Support instances must treat those appliances as potentially compromised until a thorough forensic audit is completed. Incident response teams should specifically inspect host filesystems for the presence of /usr/bin/dbus-authd with SUID root bits set, audit modifications to /ns/config/haproxy.conf, inspect execution logs for /ns/sbin/bt-secrets, and search web directories for unauthorized PHP scripts corresponding to the SAWFLY web shell payload.