BeyondTrust Remote Support zero-day exploited by China-linked hackers since August

BeyondTrust has released fixes for a critical vulnerability in its Remote Support product that a suspected China-nexus espionage group exploited as a zero-day since late August 2026, according to BleepingComputer and The Hacker News. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, was disclosed by the company on October 15. Because Remote Support appliances store and broker privileged credentials for downstream systems, a compromise can give attackers broad access to a victim's network.

What happened

According to The Hacker News, the flaw was first exploited on August 29, 2026 against a single self-hosted Remote Support appliance. BeyondTrust said it started looking for similar activity after the "successful exploitation of another security device provider" became public on September 27. The company pushed patches to all Remote Support SaaS customers by October 9, The Hacker News reported; BleepingComputer said SaaS customers of Remote Support and Privileged Remote Access were patched on October 8.

Mandiant and Google Threat Intelligence Group (GTIG) attribute the activity to Armory Castle, a group previously tracked as UNC5221 and known to CrowdStrike as Warp Panda. The group has a history of exploiting edge appliances, including Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282), the reports note.

Technical details

BeyondTrust's advisory BT26-05 says internal messaging components "did not adequately validate the origin of the messages" they received, allowing a remote attacker to perform file operations on an affected appliance under the right conditions. BleepingComputer describes it as an authentication bypass.

Per GTIG and Mandiant, as reported by The Hacker News, the attackers copied /bin/sh to /usr/bin/dbus-authd with root ownership and the SUID bit to gain root, deployed the PHP web shell SAWFLY and a C-based SOCKS5 tunneler called BARECLAW, and modified /ns/config/haproxy.conf to expose the tunneler to the internet. They tried to harvest passwords, API keys and endpoint credentials with the /ns/sbin/bt-secrets utility, used stolen administrator credentials to open sessions to systems in the Jump Item list, downloaded internal documents and systematically deleted logs. Commercial VPN nodes and compromised home routers were used to hide the infrastructure.

Who is affected

The issue affects BeyondTrust Remote Support (formerly Bomgar). BleepingComputer cites Shadowserver data showing more than 1,400 internet-exposed Remote Support instances, without indicating how many remain unpatched. BeyondTrust says it serves more than 20,000 customers, including government agencies.

What to do

Self-hosted customers on versions 24.3.1 through 26.2.3 should apply the BT26-05-RS patch, while those on older releases must upgrade, according to The Hacker News. Mandiant advises that any appliance reachable from the internet on a vulnerable version during the exploitation window "should be treated as potentially compromised until it has been reviewed." Administrators should look for the dbus-authd binary, SAWFLY, BARECLAW, changes to haproxy.conf and gaps in logs, and rotate credentials stored or brokered by the appliance. Mandiant also warned that wider exploitation attempts may follow.