BeyondTrust warned its customers of a critical security vulnerability in its Remote Support (RS) solution after confirming that it had been exploited in zero-day attacks since late August. The vulnerability, tracked as CVE-2026-102764, affects versions 26.2.3 and earlier and allows a remote, unauthenticated attacker to bypass authentication and perform file operations on unpatched devices.
The company issued the patch on October 8 for Remote Support and Privileged Remote Access customers using SaaS versions. In self-hosted environments, administrators must install the update manually if automatic updates are not enabled. Although BeyondTrust’s internal testing did not identify a way to exploit the vulnerability in Privileged Remote Access, the product shares the affected code with Remote Support. The company therefore also issued a patch for it and recommends that its self-hosted customers apply it immediately.
Exploitation for Access and Privilege Escalation
Mandiant and the Google Threat Intelligence Group observed the attacks and attributed them to an actor called Armory Castle, formerly known as UNC5221, while CrowdStrike calls it Warp Panda. The group is suspected of having ties to China.
The attackers exploited the vulnerability to gain initial access to devices, then escalated their privileges to root by enabling Set User ID (SUID) permissions. They subsequently deployed the Sawfly web shell and the Bareclaw tool for lateral movement, erased logs to reduce the chances of detection, and used compromised Administrator credentials to open remote sessions on other systems inside the network.
According to Mandiant, root-level access to the host gave the attackers the ability to access credentials stored or relayed by the device, modify files that persist after reboot, and reset configurations. The researchers therefore recommended treating any internet-exposed device running an affected version during the exploitation period as compromised until it has been reviewed.
Why Does This Matter?
The vulnerability combines three factors that increase its severity: exploitation in the wild before a patch was available, Remote Support’s position at the network perimeter, and the possibility of accessing credentials used by support teams and connected systems. Shadowserver is also tracking more than 1,400 BeyondTrust Remote Support instances exposed on the internet, without clarifying how many devices have been secured or represent test honeypots.
This does not mean that all exposed devices have been compromised, but it makes checking logs, reviewing accounts and files, and installing the patch an immediate priority, especially for organizations using self-hosted versions.
Threat Context and Open Questions
Armory Castle has a history of targeting network-edge devices, including Citrix NetScaler and Ivanti Connect Secure, to gain access to enterprise networks and deploy custom malware. Mandiant warned that exploitation could expand after the disclosure of CVE-2026-102764, as occurred in previous campaigns that began with selective exploitation of vulnerabilities and then turned into widespread activity after information about them emerged.
The source does not specify how many organizations were compromised in the current campaign or whether the credentials of specific customers were stolen. Installing the patch therefore remains essential, but it does not replace investigating devices that were exposed during the exploitation window.