China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
In late August 2026, a Chinese-linked hacking group known as Armory Castle successfully exploited a zero-day vulnerability in BeyondTrust Remote Support, a remote access software. The vulnerability, CVE-2026-102764, is a result of improper validation of internal messages and allows remote attackers to perform file operations on affected appliances.
BeyondTrust released patches for the flaw through its Software as a Service (SaaS) offering by October 9, 2026. Customers running self-hosted versions of Remote Support between 24.3.1 and 26.2.3 were advised to manually update to patch BT26-05-RS. Versions older than 24.3.1 were required to upgrade to a newer version to apply the fix.
Armory Castle, a cyber espionage group with a history of exploiting zero-day vulnerabilities in various software, including Citrix NetScaler and Ivanti Connect Secure, targeted the remote support appliance on August 29, 2026. Following the successful exploitation, Armory Castle initiated an investigation to track similar activity.
The compromised appliance was used to deploy a lightweight PHP web shell, SAWFLY, for remote access and command-and-control communication. The operator employed commercial VPN exit nodes and compromised home and small-office routers to blend into regular traffic. The web shell facilitated privilege escalation, full administrative control, persistence, and credential theft.
The intrusion extended to downstream systems, enabling lateral movement. Any reachable appliance on a vulnerable version should be considered potentially compromised until thoroughly reviewed.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
