A prominent China-nexus cyber espionage group, known as **Armory Castle** (also referred to as UNC5221 or Warp Panda), has been caught exploiting a newly disclosed zero-day vulnerability in **BeyondTrust Remote Support**. The flaw, designated **CVE-2026-102764** and boasting a CVSS score of 9.3, stems from improper origin validation within an internal messaging component. This weakness could be leveraged by a remote attacker to execute file operations on vulnerable appliances. **BeyondTrust** confirmed the vulnerability's nature, stating, "The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance."  ### Patching and Remediation Patches for **CVE-2026-102764** have been rolled out to all **Remote Support SaaS** customers as of October 9, 2026. Self-hosted customers running versions from 24.3.1 through 26.2.3 are urged to apply the BT26-05-RS patch. Those on versions older than 24.3.1 must upgrade to a newer version before applying the fix. ### The Attack Timeline **BeyondTrust**'s timeline reveals that **Armory Castle** exploited the zero-day on a single self-hosted **Remote Support** appliance on August 29, 2026. A subsequent public disclosure of a successful exploit against another security device provider on September 27, 2026, prompted **BeyondTrust** to initiate an investigation, leading to the discovery of this activity. ### Armory Castle's Modus Operandi **Armory Castle** has a history of exploiting zero-day vulnerabilities in critical appliances, including **Citrix NetScaler** (**CVE-2023-4966**) and **Ivanti Connect Secure** (**CVE-2023-46805**, **CVE-2024-21887**, and **CVE-2025-0282**). Active since October 2023, the group targets various sectors, such as legal services, SaaS providers, business-process outsourcers, technology, and government entities, for long-term intelligence gathering. "The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched," **BeyondTrust** stated. They further assess that **Armory Castle** likely leverages AI to develop exploit chains against high-value software targets.  ### Post-Exploitation Tactics **Mandiant**, owned by **Google**, provided additional insights into the exploitation. Successful compromises are followed by the deployment of **SAWFLY**, a lightweight PHP web shell used for interactive remote access and encrypted command-and-control (C2) communication. The attackers utilize commercial VPN exit nodes and compromised home/small-office routers to evade detection. The web shell acts as a conduit to escalate privileges, gain full administrative control, and establish persistence that survives reboots. Intrusions by **Armory Castle** are characterized by efforts to steal credentials, read stored secrets, and abuse administrative access for lateral movement. Key post-exploitation actions include: * Gaining root-level control by modifying system shell executables. * Harvesting credentials from the appliance's native secrets management database using the proprietary `/ns/sbin/bt-secrets` CLI utility. * Targeting **BeyondTrust** configuration templates to obtain passwordless root privileges. * Pivoting into the **BeyondTrust Remote Support** application for reconnaissance via compromised administrator credentials and launching remote sessions to downstream systems listed in **Jump Item** lists. * Abusing elevated administrative privileges to establish remote support sessions, gaining full file-system access, and exfiltrating sensitive internal documents. * Tunneling traffic through the **BeyondTrust** device using **BARECLAW**, a custom C-based SOCKS5 proxy tunneler. * Modifying `/ns/config/haproxy.conf` to expose **BARECLAW** directly to the internet. * Systematically deleting system, web server, and application-level logs to hinder detection. Researchers from **Google Threat Intelligence Group (GTIG)** and **Mandiant** highlighted **Armory Castle's** deep understanding of **BeyondTrust** appliance internals, evidenced by their abuse of proprietary CLI utilities, startup configuration templates, and local reverse-proxy routing. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," they warned. ### CISA Advisory and Call to Action On October 16, 2026, the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** issued an advisory, urging organizations with affected **BeyondTrust Remote Support** appliances to take immediate action: * Apply the BT26-05-RS patch. * Limit external access to the **Remote Support** appliance to only necessary services. * Conduct network and memory forensics to identify signs of compromise. * Isolate suspected or confirmed compromised appliances, hunt for threat actor activity, and collect forensic images. * Rebuild from a known-good state and then apply the BT26-05-RS patch. **CISA** has also added **CVE-2026-102764** to its **Known Exploited Vulnerabilities (KEV)** catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 19, 2026.