Patch BeyondTrust Remote Support to Block Chinese Espionage Group’s Zero-Day Exploit
Attackers used an unpatched file-upload flaw in BeyondTrust appliances to gain root access and tunnel into victim networks before the vendor issued a fix.
Key points
- A China-linked group exploited CVE-2026-102764 in late August 2026 to upload files and escalate privileges to root on BeyondTrust Remote Support appliances.
- The attackers deployed the SAWFLY webshell and BARECLAW tunneler to maintain persistent access and move laterally within victim networks.
- BeyondTrust disclosed the vulnerability on October 15, 2026, and has published patches and guidance to address the critical security flaw.
A suspected China-linked espionage group known as ARMORY CASTLE gained root access to BeyondTrust Remote Support appliances by exploiting a critical zero-day vulnerability in late August 2026, according to Mandiant and Google Cloud Researchers. The attackers used this initial foothold to deploy persistent backdoors and tunnel into victim networks weeks before the vendor publicly disclosed the flaw on October 15, 2026.
The intrusion began with the exploitation of CVE-2026-102764, which allowed unauthenticated remote attackers to perform arbitrary file operations on internet-facing appliances. Mandiant found that the group uploaded a PHP webshell named SAWFLY, which used custom encryption to evade routine scanning. From an unprivileged service account, the attackers escalated to root privileges by manipulating system files and enabling Set User ID permissions on a copied shell binary.
Context and Background
ARMORY CASTLE, previously tracked as UNC5221, demonstrated detailed knowledge of BeyondTrust internal components, including command-line utilities and reverse-proxy routing, during the campaign. This appliance-specific expertise allowed the group to turn initial access into durable control. The attackers targeted native secrets-management utilities to retrieve credentials from site-specific vaults and appliance-wide password safes before deleting associated logs.
Who Is Affected
The vulnerability affects BeyondTrust Remote Support appliances, formerly known as Bomgar, which IT teams use to securely connect to and troubleshoot remote systems. Because these appliances often serve as gateways to internal endpoints, a breach can expose more than just the appliance itself, potentially granting attackers access to managed systems. Organizations using these internet-facing devices are at risk if they have not applied the patches released by BeyondTrust following the October 15, 2026 disclosure.
What to watch
Security teams should monitor for anomalous file uploads and unexpected changes to system binaries on remote support appliances. Look for the creation of new executables with elevated permissions, such as the SUID bit enabled on copied shells, which indicates privilege escalation attempts. Additionally, watch for network traffic patterns associated with tunneling tools like BARECLAW, which attackers used to maintain persistent access and move laterally within victim environments.
What made it possible
This incident illustrates how attackers leverage initial access to escalate privileges and maintain persistence. Teams usually face challenges when unprivileged service accounts can manipulate system files or permissions. Check whether your appliances restrict file operations and monitor for unusual changes to executable attributes. Understanding how attackers move from initial foothold to root control helps in designing detection rules that catch privilege escalation attempts before they result in full system compromise.
Background: Privilege escalation vulnerabilities
Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.
Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks
What to do and how to stay safe: BeyondTrust
- Verify that all BeyondTrust Remote Support appliances are updated with the latest vendor patches addressing CVE-2026-102764.
- Monitor appliance logs for unauthorized file uploads or modifications to system binaries, especially those involving shell commands.
- Review permissions on critical system directories to ensure no unauthorized executables have been created or modified with elevated privileges.
- Once the vendor provides an update, test it in a non-production environment before deploying to ensure compatibility with existing configurations.
Step-by-step guide: Multi-Factor Authentication Setup for Small Teams
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102764?
CVE-2026-102764 is a critical vulnerability in BeyondTrust Remote Support appliances that allows unauthenticated remote attackers to perform arbitrary file operations.
Which threat actor is responsible for this exploitation?
Mandiant attributes the activity to ARMORY CASTLE, a suspected China-nexus espionage group previously tracked as UNC5221.
Did the attackers successfully steal credentials?
The attackers targeted BeyondTrust’s native secrets-management utility to retrieve credentials from vaults and password safes, then deleted related logs.
