BeyondTrust Remote Support Zero‑Day Exploited by Chinese State‑Backed Group

What Happened

On October 16, 2026, BeyondTrust confirmed that a previously unknown vulnerability in its Remote Support appliances was actively exploited by the Chinese state‑backed group Armory Castle (UNC5221). The flaw, identified as CVE‑2026‑102764, allowed attackers to elevate privileges, exfiltrate stored credentials, and modify persistent configuration files.

Impact

Attackers leveraged custom malware—Sawfly and Bareclaw—to maintain footholds and conduct long‑term intelligence collection. Targets included legal services, SaaS providers, business‑process outsourcers, technology firms, and government entities. Any appliance reachable from the internet is considered potentially compromised until a thorough review is completed.

Mitigations & Patch

BeyondTrust released a patch on October 16 that addresses the privilege‑escalation flaw. In the interim, administrators should:

• Isolate or shut down exposed appliances.
• Disable remote support services that are not required.
• Apply the vendor’s recommended configuration hardening steps.
• Monitor for anomalous credential usage and lateral movement.

Defender Actions

Security teams should verify that all Remote Support appliances are updated to the latest firmware. Conduct a rapid assessment of any device that was exposed to the internet during the exploitation window. If an appliance was found running the vulnerable version, treat it as compromised and perform a full forensic review.