### Critical BeyondTrust Flaw Exploited in the Wild **BeyondTrust** has issued an urgent warning to customers regarding a critical zero-day vulnerability, **CVE-2026-102764**, in its **Remote Support (RS)** solution. The flaw, an authentication bypass, has been actively exploited since late August, allowing unprivileged remote attackers to execute file operations on unpatched appliances. **Remote Support** is an enterprise-grade solution widely used by IT service desks and customer support teams for remote troubleshooting. While **BeyondTrust** patched the issue for all **Remote Support** and **Privileged Remote Access** SaaS customers on October 8, self-hosted installations require manual patching if automatic updates are not enabled. ### Espionage Group Leverages Zero-Day Limited details have been shared about the vulnerability, but **BeyondTrust** confirmed its exploitation in the wild by a suspected China-nexus espionage actor. This group is tracked by **Mandiant** and **Google Threat Intelligence Group (GTIG)** researchers as **Armory Castle** (formerly **UNC5221**) and by **CrowdStrike** as **Warp Panda**. According to **Mandiant**, **Armory Castle** exploited **CVE-2026-102764** to gain initial access and escalate to root privileges on compromised devices by enabling Set User ID (SUID) permissions. Following this, they deployed new **Sawfly** web shell and **Bareclaw** tunneler malware, wiped logs to evade detection, and moved laterally across victim networks using compromised Administrator credentials. > "After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," **Mandiant** stated. > "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." ### A Pattern of Targeting Edge Appliances **Armory Castle** is known for its focus on zero-day vulnerabilities in network edge appliances. Previous targets include **Citrix NetScaler** (**CVE-2023-4966**) and **Ivanti Connect Secure** (**CVE-2023-46805**, **CVE-2024-21887**, and **CVE-2025-0282**). These attacks, dating back to at least October 2023, aim to breach enterprise networks and deploy custom malware. For instance, **Volexity** reported in January 2024 that **UNC5221** had backdoored over 2,100 **Ivanti** appliances using the **GiftedVisitor** webshell, chaining **CVE-2023-46805** and **CVE-2024-21887**. > "In past campaigns, **ARMORY CASTLE** has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed," **Mandiant** added. "It is possible that we will observe similar widespread exploitation attempts associated with **CVE-2026-102764**." ### Persistent Threats Against BeyondTrust **CVE-2026-102764** is not the first **BeyondTrust** flaw exploited in the wild. Recently, attackers leveraged another critical remote code execution vulnerability, **CVE-2026-1731**, affecting **Remote Support** and **Privileged Remote Access** appliances to establish WebSocket channels and deploy ransomware. Furthermore, the Chinese state-backed **Silk Typhoon** hacking group is suspected of exploiting two zero-days, **CVE-2024-12356** and **CVE-2024-12686**, to breach **BeyondTrust's** systems. This resulted in the compromise of 17 **Remote Support** SaaS instances, including the **U.S. Treasury Department's** instance. The same campaign also targeted the **Office of Foreign Assets Control (OFAC)** and the **Committee on Foreign Investment in the United States (CFIUS)**. **BeyondTrust** provides identity security services to over 20,000 customers globally, including government agencies and 75% of Fortune 100 companies, making these repeated breaches a significant concern for critical infrastructure.  *Attack chain (Mandiant / GTIG)* Internet threat watchdog **Shadowserver** currently tracks over 1,400 **BeyondTrust** remote support instances exposed online, underscoring the potential attack surface.