China‑linked espionage group exploits critical BeyondTrust Remote Support vulnerability

A critical zero‑day flaw in BeyondTrust Remote Support, identified as CVE‑2026‑102764, was first used by a China‑nexus espionage group called Armory Castle in late August 2026. The bug, which allows unauthenticated attackers to perform file operations on the appliance, enabled the group to gain root‑level control of affected systems. Google Threat Intelligence and Mandiant reported the activity, and BeyondTrust issued a patch on October 8/9.

Attack methodology

Once inside, the attackers deployed a lightweight PHP web shell known as Sawfly, which was used to elevate privileges by copying the system shell to /usr/bin/dbus‑authd, setting its ownership to root and enabling SUID. They also installed the Bareclaw SOCKS5 tunneler to move traffic through the appliance and used the proprietary bt‑secrets command to dump the credential vault. The group deleted a dozen system, web server and application logs to hide its presence while it moved laterally and adjusted Jump Item permissions to administrator.

BeyondTrust’s advisory said that SaaS customers were patched automatically on October 9, while self‑hosted appliances must be updated manually to the BT26‑05‑RS patch. The vendor and security analysts recommend limiting administrative interfaces to trusted networks, forwarding appliance system logs and session events to a security information and event management platform, preserving telemetry, snapshotting appliances before reboot, and rotating credentials only after the patch is applied. The incident underscores the risk of edge and remote‑access tools as targets for nation‑state espionage.