BeyondTrust Remote Support zero-day exploited by Armory Castle

On 15 October BeyondTrust published advisory BT26-05 on a critical vulnerability in Remote Support (RS), the remote assistance product used by help desks and IT service teams: CVE-2026-102764, with a CVSS 4.0 score of 9.3. The same day Mandiant and Google Threat Intelligence Group (GTIG) attributed the exploitation, which began on 29 August, to Armory Castle, a suspected China-nexus espionage group formerly tracked as UNC5221 and known to CrowdStrike as Warp Panda. The advisory from Germany’s BSI (CERT-Bund) reports the same attribution. The patch for self-hosted installations has been available since 8 October.

The vulnerability

According to the BSI, the flaw stems from insufficient validation of message origin in an internal messaging component: under certain conditions an unauthenticated remote attacker can perform file operations on the appliance. From there, Mandiant explains, the attacker reaches control of the host and every credential the appliance stores or brokers. BeyondTrust is withholding further technical details while customers patch.

• Affected versions: Remote Support up to and including 26.2.3.
• Fix: patch BT26-05-RS for versions 24.3.1 through 26.2.3, installable from the /appliance interface. Versions older than 24.3.1 must be upgraded first; upgrading does not remove a compromise that already happened.
• Privileged Remote Access (PRA): shares the vulnerable code. BeyondTrust found no way to exploit it, but released the patch as a precaution and recommends applying it immediately.
• SaaS: cloud instances of RS and PRA were patched automatically. The dates differ: BleepingComputer and CyberScoop give 8 October, while SecurityWeek and CSO Online, quoting BeyondTrust and Mandiant, say the rollout was complete on 9 October.

Timeline

The first known exploitation dates back to 29 August, against one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust discovered the intrusion on 28 September, after the compromise of another vendor’s appliances became public and Mandiant sent a non-specific warning. According to CSO Online, BeyondTrust’s sensors flagged the privilege escalation in real time, but the automated triage of a third-party detection platform closed the alerts as false positives.

GTIG speaks of “a small number” of impacted organisations, without ruling out further victims before disclosure. BeyondTrust has not said how many customers were compromised.

The attack chain

Mandiant and GTIG describe an intrusion built on deep knowledge of the appliance:

1. Web shell: about 11 minutes after the first malicious request, SAWFLY appears in the web root, an obfuscated PHP web shell with encrypted command and control.
2. Escalation to root: /bin/sh is copied to /usr/bin/dbus-authd, owned by root and given the SUID bit.
3. Persistence: a startup script writes a passwordless sudo entry into BeyondTrust’s sudoers template, which survives reboots and configuration resets.
4. Credentials: repeated attempts with /ns/sbin/bt-secrets, the proprietary tool that manages passwords, API keys and endpoint credentials, to dump the secrets vault.
5. Clean-up: more than a dozen system, web server and application logs deleted.
6. Lateral movement: using compromised administrator credentials, the account’s Jump Item and Team permissions are raised from “No Access” to “Administrator”, allowing remote sessions to every system in the Jump Item list. RS file transfer is used to steal documents useful for reconnaissance, such as software inventories.
7. Tunnel: BARECLAW, a custom SOCKS5 tunneler, reached by editing the appliance’s HAProxy configuration to point at a hidden local listener.

In MITRE ATT&CK terms: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1548.001 (Setuid and Setgid), T1548.003 (Sudo and Sudo Caching), T1555 (Credentials from Password Stores), T1070.002 (Clear Linux or Mac System Logs), T1098 (Account Manipulation), T1572 (Protocol Tunneling).

According to BeyondTrust the group rotates infrastructure and tooling for every victim: the sources report no addresses or hashes. The public indicators are behavioural: /usr/bin/dbus-authd, unexpected sudo entries, unknown PHP files in the web root, HAProxy changes, use of bt-secrets, changes to Jump Item and Team permissions, missing logs.

Who Armory Castle is

Active since at least October 2023, the group conducts long-term espionage against legal services, SaaS providers, business-process outsourcers, technology companies and government. It has previously exploited zero-days in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282). After the Ivanti flaws were disclosed it moved to mass exploitation, and GTIG considers the same pattern possible now. According to Shadowserver, quoted by BleepingComputer, more than 1,400 Remote Support instances are exposed on the Internet.

Impact for European and Italian companies

Remote Support is a privileged entry point: it reaches workstations and servers and holds the credentials to do so. Organisations that use it to support their customers, such as managed service providers, extend the risk to their customers’ networks: a supply-chain issue at the heart of NIS2. A compromise is an incident to assess for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). In healthcare, these tools often provide remote access to clinical systems managed by external suppliers.

What to do now

For Mandiant, any appliance reachable from the Internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.

1. Preserve evidence: snapshot the appliance before rebooting it, because customers cannot examine the host file system.
2. Patch Remote Support and PRA with BT26-05-RS.
3. Isolate: block inbound traffic to the public address at the firewall, not only in /appliance; allow outbound traffic only to BeyondTrust update and licensing endpoints, logging every denied connection.
4. End sessions: terminate active ones and disable new sessions, Jump Clients, Jumpoints and API accounts from /login.
5. Rebuild compromised or uncertain appliances from a clean image, then redeploy Jump Clients, Jumpoints and the console to invalidate tokens.
6. Rotate credentials after patching and in dependency order, so new secrets do not land on a system the attacker still controls. Mandiant says this applies to SaaS customers too; BeyondTrust says they need take no further action.
7. Restrict /login and /appliance by IP address or network segment and enable MFA on the built-in Admin account.
8. Hunt from late August onwards: unusual remote sessions to downstream systems, file transfers, new administrative permissions.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet and which have known vulnerabilities: it helps you find the remote support appliances to check. ARX Sentry collects logs and events from computers, servers and firewalls, including privileged logons and remote desktop. With ARX Trace, analysts launch collections and searches on the machines reached by remote sessions.

Last updated: 16 October 2026