China-Linked Spies Used a BeyondTrust Zero-Day to Steal the Credentials Locked Inside Remote-Access Appliances

A suspected Chinese espionage crew found a way into one of the most sensitive boxes a company can own. Mandiant says the group it now calls ARMORY CASTLE, previously tracked as UNC5221, exploited a zero-day in BeyondTrust Remote Support in late August, took full control of the appliances and went straight for the credentials they hold.

That target is the point. Remote Support, formerly known as Bomgar, is what IT teams use to reach into other machines. It stores and brokers the passwords and keys that open those machines. Owning the appliance means owning a large share of the keys to the network.

What the flaw does

BeyondTrust disclosed the bug on October 15 as CVE-2026-102764, rated 9.3 on CVSSv4. It is an improper origin validation flaw in an internal messaging component. An unauthenticated attacker on the network can perform file operations on the appliance, which can lead to control of the host and access to every credential the appliance stores or brokers.

Every Remote Support version up to and including 26.2.3 is affected. The fix ships as the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Anyone running something older has to upgrade first.

What the attackers did once inside

Mandiant's incident responders pieced together the intrusion. The attackers used the file upload capability to plant a webshell Mandiant calls SAWFLY, an obfuscated PHP backdoor with encrypted command traffic. From there they escalated to root on the appliance and tried to dump its secrets vault through BeyondTrust's own command-line tooling.

They then dug in. Mandiant describes a boot script that kept their access alive across restarts, deleted logs, and abuse of the admin portal to raise permissions on Jump Items to Administrator. For a durable path back in, they deployed BARECLAW, a custom tunneling tool, and adjusted the appliance's web proxy configuration to expose it.

How it unfolded

BeyondTrust has published its own timeline. On August 29, the attackers hit one BeyondTrust-hosted Remote Support instance and one self-hosted appliance. Nothing was caught for a month. On September 27, after another vendor's edge zero-day went public, BeyondTrust started hunting. The next day it contained the affected SaaS instance within 27 minutes of detection.

Mandiant shared its findings on the self-hosted appliance on September 30. Patches went out to cloud and self-hosted customers on October 8, with the SaaS fleet updated automatically by October 9. Public disclosure followed on October 15. BeyondTrust is holding back technical exploit details while self-hosted customers catch up.

A familiar crew, a familiar pattern

Google Threat Intelligence attributes the zero-day and both tools to ARMORY CASTLE, which CrowdStrike tracks as WARP PANDA. The same actor has been tied to zero-days in Citrix NetScaler and Ivanti Connect Secure, and it prefers exactly this kind of internet-facing remote-access gear. The pattern echoes the Ivanti Connect Secure zero-day chains that handed attackers root on VPN boxes.

What worries Google most is what this group tends to do next. ARMORY CASTLE historically uses a zero-day sparingly against chosen targets, then shifts to broad, opportunistic exploitation once the flaw is public. Google and Mandiant are warning organizations to prepare for potential widespread attacks now that disclosure is out.

Cloud customers are already patched. Self-hosted operators need BT26-05 applied urgently, and BeyondTrust says any vulnerable appliance reachable from the internet during the exposure window should be treated as potentially compromised until it has been reviewed.

Some offers on this page may be paid placements or contain affiliate links.