Warp Panda (Threat actor): news timeline & CVEs

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.

Mandiant and Google’s threat intelligence group say China-linked Armory Castle, also tracked as UNC5221 and Warp Panda, exploited BeyondTrust Remote Support flaw CVE-2026-102764 as a zero-day starting August 29, 2026. The CVSS 9.3 bug allows file operations through improper validation of message origins and affects all Remote Support versions through 26.2.3; patch BT26-05-RS covers 24.3.1 through 26.2.3, and BeyondTrust says SaaS customers were patched by October 9. Attackers deployed the Sawfly PHP webshell and Bareclaw SOCKS5 tunneler, obtained root, harvested credentials, deleted logs, and exfiltrated internal documents via the product’s file-transfer feature. The group has previously exploited zero-days in Citrix NetScaler, Ivanti Connect Secure, and Dell RecoverPoint.

SecurityWeekupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:53 UTC · 17h agoExploit / PoC in the wild 16 sources CVE-2026-102764 CVE-2023-4966 CVE-2023-46805+3 CVEs1· 1 read

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.

Mandiant and Google Threat Intelligence Group say Armory Castle, a suspected China-nexus espionage actor formerly tracked as UNC5221 and by CrowdStrike as WARP PANDA, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting Aug. 29, 2026. The unauthenticated flaw, CVSS 9.3, allows file operations, host-level control, and access to credentials the appliance stores or brokers. The actor deployed the SAWFLY PHP web shell, a SUID root backdoor, passwordless sudo persistence, and the BARECLAW SOCKS5 tunneler, then wiped logs. BeyondTrust released a patch on Oct. 8 in advisory BT26-05; self-hosted internet-exposed systems should be reviewed, while SaaS instances were patched automatically.

CSO Onlineupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:24 UTC · 17h agoExploit / PoC in the wild 16 sources CVE-2026-102764

Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks

China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.

BeyondTrust and Mandiant say a suspected China-nexus espionage cluster exploited critical zero-day CVE-2026-102764 in BeyondTrust Remote Support on 29 August 2026, hitting one hosted instance and one self-hosted appliance, then deleted logs and tooling. BeyondTrust assesses with moderate to high confidence that the actor is UNC5221, which Mandiant calls ARMORY CASTLE and CrowdStrike tracks as WARP PANDA, previously linked to Citrix NetScaler and Ivanti Connect Secure zero-days. The intruder used a custom web shell and tunneling tool, reached full admin control within minutes, and read stored secrets. SaaS instances were patched automatically; self-hosted Remote Support and Privileged Remote Access need advisory BT26-05. Technical details are being withheld while appliances are patched.

GBHackersupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 09:35 UTC · 18h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes

Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.

Mandiant says suspected China-nexus espionage group ARMORY CASTLE, previously UNC5221 and also called WARP PANDA, exploited CVE-2026-102764 in BeyondTrust Remote Support starting August 29, 2026. The unauthenticated flaw, in versions through 26.2.3, allows remote file operations that can lead to full host control. Attackers installed the SAWFLY PHP web shell, escalated to root, persisted with a startup script, tunneled traffic using BARECLAW, expanded Jump Item access, collected data, and deleted logs. BeyondTrust patched on October 8, hosted tenants were updated by October 9, and a precautionary Privileged Remote Access patch was also released.

Cyber Security Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 08:17 UTC · 19h agoExploit / PoC in the wild 16 sources CVE-2026-102764

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.

BeyondTrust said CVE-2026-102764, CVSS 9.3, is improper origin validation in Remote Support internal messaging that lets a remote attacker perform file operations. China-nexus group Armory Castle, also tracked as UNC5221 and Warp Panda, exploited it as a zero-day on August 29, 2026 against one self-hosted appliance. SaaS customers were patched by October 9; self-hosted versions 24.3.1 through 26.2.3 need patch BT26-05-RS. Mandiant reported follow-on use of the SAWFLY PHP web shell, SUID privilege escalation, secret harvesting, Jump remote sessions, the BARECLAW SOCKS5 tunneler, and log deletion.

The Hacker Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 06:55 UTC · 21h agoExploit / PoC in the wild 16 sources CVE-2026-102764 CVE-2023-4966

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.

BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support 26.2.3 and earlier that lets unprivileged remote attackers perform file operations. Mandiant and Google Threat Intelligence Group say China-nexus Armory Castle, also UNC5221 and CrowdStrike's Warp Panda, exploited it since late August, gained root through SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved laterally with stolen administrator credentials. SaaS customers were patched on October 8, while self-hosted systems require a manual update. Shadowserver tracks more than 1,400 exposed instances, and Mandiant warned exploitation may broaden now that the flaw is public.

BleepingComputerOct 16, 06:18 UTC · 21h agoExploit / PoC in the wildCVE-2026-102764 CVE-2023-4966 CVE-2023-46805+5 CVEs1· 1 read

Warp Panda

Timeline6 articles

Related CVEsby mentions

Appears with