Suspected China-linked group exploited BeyondTrust Remote Support zero-day before patch

TLDR

• BeyondTrust disclosed CVE-2026-102764, a critical Remote Support flaw a suspected China-nexus actor exploited as a zero-day.¹
• Now the flaw is public, Google and Mandiant warn the actor and others may exploit it widely.²
• CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 October and urged immediate patching of self-hosted appliances.³

Update, 17 October, what changed: CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalogue on 16 October and issued an alert saying threat actors are actively exploiting the authentication bypass for initial access, persistence, privilege escalation and lateral movement.³ The alert lists Remote Support 26.2.3 and earlier as affected, says patches cover supported versions 24.3.1 and later (older installations must upgrade first) and says BeyondTrust-hosted SaaS deployments are already patched.³ For appliances suspected of compromise, CISA advises isolating them and taking snapshots for forensics, rebuilding from a known-good state, rotating every credential the appliance stored or injected, revoking active sessions and reviewing new multifactor authentication registrations on privileged accounts.³ Cybersecurity Dive reports the deadline for US federal civilian agencies to mitigate is Monday 19 October; the CISA alert itself does not give a date.⁷

Mandiant's technical write-up, published on 15 October, says exploitation results in arbitrary file upload, and describes ARMORY CASTLE (suspected PRC-nexus, formerly UNC5221) using it as a zero-day from late August during an incident response engagement.⁴ It says a custom PHP web shell it calls SAWFLY appeared about 11 minutes after the first malicious POST request, that the actor escalated to root by copying /bin/sh to a SUID file named /usr/bin/dbus-authd, tried to harvest vault credentials, deleted logs and artefacts, and used a custom SOCKS5 tunneller called BARECLAW.⁴ SecurityWeek adds that the actor used the product's native file-transfer service to exfiltrate documents such as software inventories.⁵

Scope remains unclear. Google Threat Intelligence Group's Kelli Vanderlee told CyberScoop it is aware of only a small number of impacted organisations at this time, but that others may be affected; BeyondTrust declined to say how many customers were compromised or why it did not disclose sooner.⁶ SecurityWeek, which gives the flaw a CVSS score of 9.3 and describes it as improper validation of message origins, lists earlier zero-days it attributes to the same actor, including CitrixBleed (CVE-2023-4966), Ivanti Connect Secure flaws and a Dell RecoverPoint bug (CVE-2026-22769).⁵

The timeline differs by source. SecurityWeek says BeyondTrust identified the defect on 28 September, had a patch by 30 September and shipped it on 8 October after further testing, with SaaS patched by 9 October.⁵ CyberScoop also gives 8 October, with SaaS patched the same day, while Cybersecurity Dive says the patch was issued on 9 October.⁶⁷ CyberScoop adds that BeyondTrust said it detected the activity after zero-days were confirmed in another vendor's product on 27 September, a date it says matches the Citrix NetScaler disclosures; BeyondTrust did not say whether the cases are linked.⁶

BeyondTrust said it published security advisory BT26-05 and CVE-2026-102764 for a critical vulnerability in Remote Support after a suspected China-nexus espionage actor exploited it as a zero-day.¹ The company assesses with moderate to high confidence that the activity belongs to the actor Google Threat Intelligence Group and Mandiant track as UNC5221, which Mandiant now calls ARMORY CASTLE and CrowdStrike tracks as WARP PANDA, and says the attribution rests on tradecraft consistent with Mandiant's.¹ Mandiant's own analysis is relayed here through BeyondTrust and Reuters and is not cited directly. Reuters reported that Google's blog post said the group had exploited the then-unknown vulnerability in August.²

BeyondTrust's timeline has the actor exploiting the flaw on 29 August. On 28 September its Cyber Defense team's proactive threat hunting found indications of the event involving the hosted customer, and it contained the instance within 27 minutes of first detection. Mandiant shared findings from the self-hosted customer on 30 September, the patch went to SaaS and self-hosted customers on 8 October, and the CVE, advisory and Mandiant's analysis were disclosed together on 15 October.¹

BeyondTrust confirmed Remote Support was vulnerable. Its internal testing has not found a way to exploit the flaw in Privileged Remote Access, but because that product shares the affected code, it has released the patch for it too and recommends self-hosted customers apply it immediately.¹ The company says the actor tends to use a zero-day against chosen targets and then move to broad exploitation of unpatched instances once a flaw is public, and that Mandiant warns defenders to expect the same here.¹ BeyondTrust also says its working assessment is that the actor may use AI tooling to develop exploit chains, while stating it has no forensic proof of this.¹

Why it matters: remote-support tools sit inside the network with broad access to the machines they manage, so a flaw that exposes credentials and lets an attacker take over the host is attractive for follow-on attacks, and the window between disclosure and mass exploitation is when unpatched self-hosted appliances are most at risk.