Chinese Espionage Group Exploits BeyondTrust Zero‑Day, Patching Followed by Broad Attack

On August 29, 2026, a Chinese state‑backed espionage group took advantage of CVE‑2026‑102764, a flaw that allowed remote attackers to bypass authentication and execute file operations on BeyondTrust Remote Support appliances. The vulnerability, which affected all RS versions up to 26.2.3, was first spotted by BeyondTrust on September 28 and fully patched on October 8. The patch was automatically applied to all SaaS customers, while self‑hosted installations required manual updates.

Tactics and Lateral Movement

Researchers at Mandiant and Google Threat Intelligence Group identified the actor, now called Armory Castle, as the operator of the zero‑day. After initial compromise, the group deployed a lightweight Sawfly web shell and the Bareclaw SOCKS5 tunneler, then elevated privileges to root, wiped local logs, and moved laterally using stolen administrator credentials. The attackers also leveraged BeyondTrust’s native file‑transfer service to exfiltrate sensitive documents before deleting evidence of their presence.

Because the exploitation began in late August, many BeyondTrust customers may already have been breached. The company urged all users to confirm the patch status, restrict privileged remote‑access interfaces to trusted networks, forward appliance logs to a SIEM, and monitor for unusual admin sessions or deleted log gaps. Mandiant warns that attackers often use unpatched systems for months before detection, so a comprehensive review of all exposed Remote Support instances is advised.