BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes

A critical zero-day vulnerability in BeyondTrust Remote Support was exploited in late August, weeks before the company disclosed the flaw and released a patch. The suspected China-linked espionage group ARMORY CASTLE used the weakness to access appliances, escalate privileges to root, and reach credentials the product stores or handles.

Mandiant says the flaw lets an unauthenticated remote attacker perform file operations on an affected appliance, which may lead to full host control.

The vulnerability is tracked as CVE-2026-102764. It affects supported BeyondTrust Remote Support versions up to and including 26.2.3. BeyondTrust says the issue lies in an internal messaging component that did not properly check where messages came from.

The company has not published the technical details of the flaw, citing the risk to customers who have not patched. Mandiant’s investigation, however, describes how the attackers used access to the appliance to install malware, raise privileges, and move into victim networks.

BeyondTrust 0-Day Vulnerability Exploited

BeyondTrust reported that the actor exploited the flaw on August 29 against one hosted Remote Support instance and one self-hosted appliance. The company says its threat hunt identified activity on a hosted instance on September 28, after reports of a separate attack on another security product prompted investigation.

The team contained the incident 27 minutes after detection. BeyondTrust released a patch on October 8, and Mandiant says all Remote Support SaaS tenants had been patched by October 9. Self-hosted customers must check their appliances and apply the relevant update.

Mandiant attributes the activity to ARMORY CASTLE, a suspected China-nexus espionage actor previously tracked as UNC5221. CrowdStrike uses the name WARP PANDA for the same activity cluster. Mandiant says the group has previously targeted edge devices and remote-access products, and warns that actors may try broader, opportunistic exploitation after a vulnerability becomes public.

The incident follows a pattern seen in earlier campaigns against edge appliances, where a flaw gives an intruder a way into systems that sit between the internet and an organization’s internal network. Cyber Security News has previously covered UNC5221-linked activity involving Ivanti Connect Secure appliances, as well as a web shell found on Ivanti VPN devices. The BeyondTrust case highlights why these appliances need the same urgent patching and monitoring as internet-facing servers.

Mandiant found that the attackers used the vulnerability to upload files and then placed a PHP web shell called SAWFLY on the appliance. A web shell is a small program that lets an intruder send commands to a compromised web server.

The attackers used it to interact with the device and raise their access from a low-privilege service account to root, the highest level of control on the appliance. Mandiant says they did this by copying a shell program, changing its ownership to root, and enabling a permission that allowed it to run with the owner’s privileges.

The attackers also set up persistence so their access could survive a reboot or configuration reset. Mandiant found a startup script that changed a system template to grant the service account password-free administrative access.

They also attempted to retrieve secrets from the appliance’s credential store. Because Remote Support can hold or pass privileged credentials to other systems, a compromised appliance could expose accounts beyond the appliance itself.

Mandiant identified another tool, BARECLAW, which created a network tunnel through the device. The actor also changed the appliance’s reverse-proxy configuration to route selected web traffic to the tunneler. In the Remote Support application, the attackers used administrator credentials and raised permissions for accounts’ Jump Items and Teams.

These controls govern which computers and groups an account can access. The changes enabled remote sessions to internal systems, where the actor used file-transfer features to collect documents and software inventory information.

Mandiant says the actor deleted system, web, and application logs, along with traces of its tools. This can leave defenders with an incomplete record on the appliance itself. Security teams should check logs sent to a separate logging or security platform, along with firewall, reverse-proxy, and web application firewall records.

Review them for unfamiliar administrator sessions, unexpected account or permission changes, unusual file transfers, unknown scripts, and gaps in log forwarding.

BeyondTrust says its hosted customers have been patched. Self-hosted organizations should apply the BT26-05-RS update. Mandiant advises customers running versions older than 24.3.1 to upgrade to a supported version before applying the patch.

BeyondTrust also released a precautionary patch for Privileged Remote Access because it shares code with Remote Support, although the company said it had not found a way to exploit the vulnerability in PRA during testing.

Patching closes the known entry point, but it does not prove an appliance was never compromised. Mandiant recommends treating internet-reachable appliances that ran a vulnerable version as potentially affected until they are reviewed.

If compromise is confirmed or cannot be ruled out, preserve evidence, isolate the appliance, and rebuild it from a clean, patched image rather than simply deleting suspicious files. After securing or rebuilding the appliance, rotate credentials it stored or handled, and investigate any systems accessed through it.

The key risk is not limited to the initial file upload. Remote-support appliances can hold trusted access to many systems, turning control of one device into a path toward sensitive accounts, internal hosts, and business data. Fast patching, off-device logging, and careful credential review can limit the damage if attackers reach the appliance first.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.