Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors

A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain access, reach root privileges and install tools for continued access.

Google Threat Intelligence Group (GTIG) says the activity took place in late August 2026, before BeyondTrust disclosed the flaw on October 15.

The vulnerability, tracked as CVE-2026-102764, could let an unauthenticated remote attacker perform file operations on an affected appliance.

Mandiant linked the activity to ARMORY CASTLE, a suspected China-nexus group previously tracked as UNC5221. The attackers used the access to deploy malware, seek stored credentials, change account permissions and reach systems managed through the appliance.

Since the Remote Support can connect to internal endpoints, a breach could expose more than the appliance itself. Analysts from Google Cloud’s Threat Intelligence Group noted that the attackers deployed the SAWFLY webshell and BARECLAW tunneler after exploiting the flaw.

Their findings describe how the group used BeyondTrust’s own appliance features, alongside custom tools, to maintain access and move deeper into victim networks. The case echoes other campaigns against edge devices, including Chinese hackers exploiting Ivanti VPN.

Chinese Hackers Exploit BeyondTrust Zero-Day

Mandiant found evidence of exploitation in several appliance log files. The attacker first sent POST requests to /app_84304470%2Ephp.

About 11 minutes later, the appliance recorded the creation of a PHP webshell named mangoapi.php in a web-root directory. Mandiant could not recover the file associated with the initial POST requests, so the staging filename should not be treated as a confirmed malware sample.

SAWFLY gave the attackers a way to send commands to the appliance. It checked incoming POST requests for a specific parameter, _c94mfe, and returned a 404 response when that parameter was absent.

When present, it decoded and decrypted the submitted data, ran PHP code, then encrypted and encoded the result before returning it. This design could make casual scans less likely to reveal the webshell.

The group then escalated from the site service account to root. Mandiant says the attackers copied /bin/sh to /usr/bin/dbus-authd, changed the file’s owner to root and enabled the Set User ID (SUID) permission.

A SUID program runs with the privileges of its owner, so this gave the attackers a route to root-level control. The incident also recalls earlier reporting on BeyondTrust vulnerability exploitation, though that report covers a different flaw and campaign.

Persistence, credential access and lateral movement

Root access let the attackers inspect the appliance’s secrets store using BeyondTrust’s bt-secrets utility. Mandiant observed attempts to retrieve credentials for a service account and then query the wider vault.

The attackers also removed records from the utility’s log files. These actions matter because Remote Support appliances may store or broker credentials used to reach other systems.

To keep access after a reboot or configuration reset, the group created a startup script named zz-root-persist. The script added the service account to a configuration template with passwordless sudo rights, then used a BeyondTrust utility to rebuild the active sudoers file.

Mandiant also found log deletion across system, web server and application locations, which could make an investigation harder. The attackers also changed a compromised administrator account’s permissions, raising access to Jump Items and teams from “No Access” to “Administrator.”

Jump Items are systems made available for remote support. With broader permissions, the actor could start sessions to downstream devices, use file-transfer tools and collect internal documents such as software inventories.

For network access, the attackers ran BARECLAW, a custom SOCKS5 tunneler that carries traffic over WebSockets. In the observed setup, it listened locally on TCP port 19800, while changes to the appliance’s HAProxy configuration routed requests with the path /uidchanarge to the tunneler.

Since the listener bound to localhost, the proxy configuration provided an indirect route to it. The method fits a wider pattern of espionage groups using edge appliances as footholds, as seen in Ivanti zero-day malware campaigns.

BeyondTrust says CVE-2026-102764 affects supported Remote Support versions up to 26.2.3. Google Cloud and Mandiant urge affected organizations to apply the BT26-05 patch.

SaaS tenants were patched on October 9, 2026; self-hosted customers should apply the BT26-05-RS patch, upgrading older versions to a supported release first. Patching closes the flaw but does not remove evidence of an earlier compromise.

Organizations should review the full exposure period, preserve external firewall and reverse-proxy logs, and check for unexpected web-root files, SUID binaries, startup scripts, sudoers changes, vault access and administrator permission changes.

If compromise is confirmed or cannot be ruled out, Mandiant recommends rebuilding from a clean, patched image rather than relying on rebooting or resetting the appliance.

Rotate credentials only after patching or rebuilding, so an attacker who still controls the device cannot capture the replacement secrets. For details, consult Google Cloud’s threat report and BeyondTrust’s BT26-05 advisory.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.