A China linked cyber espionage group tracked as Armory Castle has been observed exploiting a newly disclosed zero day vulnerability in BeyondTrust Remote Support appliances to gain unauthorized access to targeted systems. The activity involved exploitation of CVE-2026-102764, a critical security flaw affecting BeyondTrust Remote Support, previously known as Bomgar. The vulnerability, which carries a CVSS score of 9.3, exists due to improper origin validation within an internal messaging component and could allow a remote attacker to perform file operations on affected appliances under specific conditions. BeyondTrust said it became aware of exploitation activity after the flaw was used against a self hosted Remote Support appliance in late August 2026.
According to BeyondTrust, the vulnerability was exploited as a zero day on August 29, 2026, before details of the issue became public. The company said the activity was identified during an investigation launched after another security device provider disclosed exploitation activity on September 27, 2026. BeyondTrust has since released security updates for affected customers, with patches pushed to Remote Support Software as a Service customers on October 9, 2026. Self hosted customers operating versions between 24.3.1 and 26.2.3 have been advised to manually install the BT26-05-RS patch, while users running older versions are required to upgrade before applying the fix. Armory Castle, previously tracked as UNC5221 or Warp Panda, has been associated with multiple campaigns involving exploitation of zero day vulnerabilities in enterprise security appliances. Researchers have previously linked the group to attacks targeting Citrix NetScaler and Ivanti Connect Secure products, affecting sectors including technology companies, government organizations, legal services, software providers, and business process organizations. BeyondTrust said the threat actor typically identifies high value software platforms in advance and uses zero day vulnerabilities against selected targets before expanding exploitation efforts after public disclosure. The company said the group’s activity demonstrates familiarity with enterprise appliance architecture and security management systems.
Google Threat Intelligence Group and Mandiant researchers reported that successful exploitation of BeyondTrust appliances was followed by deployment of a lightweight PHP web shell known as SAWFLY. The web shell provided interactive remote access and encrypted command and control communication capabilities. Researchers said the attackers used commercial VPN exit nodes and compromised home and small office routers to blend their activity with normal network traffic. After gaining access, the operators attempted to escalate privileges, maintain persistence, and access connected systems through compromised appliances. The post exploitation activity included attempts to gain root level control of affected systems, access stored credentials, and use BeyondTrust administrative privileges to move into connected environments. Researchers observed the attackers copying system shell files, modifying permissions, and using native BeyondTrust utilities to access stored secrets such as passwords, API keys, and endpoint credentials. The activity also involved targeting configuration templates to obtain elevated privileges, using compromised administrator accounts for reconnaissance, and launching remote sessions to downstream systems connected through BeyondTrust Jump Items.
Researchers further observed attempts to establish additional communication channels through BARECLAW, a custom SOCKS5 proxy tunneling tool written in C. The attackers modified configuration files to make the tunneling mechanism accessible externally and removed system, web server, and application logs in an effort to reduce forensic visibility. According to GTIG and Mandiant, the intrusion showed detailed knowledge of BeyondTrust appliance internals, including proprietary command line utilities, startup configurations, and local routing mechanisms. The researchers advised that any appliance exposed to the internet while running a vulnerable version during the exploitation period should be considered potentially affected until security reviews are completed. Organizations using BeyondTrust Remote Support are encouraged to apply available patches and review systems for signs of unauthorized activity.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
