{"id":10026,"date":"2026-10-16T10:24:19","date_gmt":"2026-10-16T10:24:19","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10026"},"modified":"2026-10-16T10:24:19","modified_gmt":"2026-10-16T10:24:19","slug":"beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10026","title":{"rendered":"BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group.<\/p>\n

\u201cOrganizations should prepare for potential widespread exploitation following this disclosure,\u201d Google Threat Intelligence Group (GTIG) and Mandiant said<\/a> in a blog post. The post attributes the zero-day exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, and dates it to late August.<\/p>\n

BeyondTrust disclosed the flaw, CVE-2026-102764<\/a>, the same day in advisory BT26-05 and said it had already released a patch on Oct. 8. According to the CVE record, it scores 9.3 on CVSS 4.0 and affects Remote Support versions up to 26.2.3. Mandiant said an unauthenticated attacker can exploit it to perform file operations, leading to host-level control and access to every credential the appliance stores or brokers.<\/p>\n

BeyondTrust urged<\/a> self-hosted customers to apply the patch immediately and said in a blog post that it is withholding technical details while they do.<\/p>\n

A month undetected<\/h2>\n

BeyondTrust\u2019s timeline puts the first exploitation on Aug. 29, against one BeyondTrust-hosted instance and one self-hosted appliance. The company found the intrusion on Sept. 28, after another vendor\u2019s edge appliances were publicly reported as compromised and Mandiant sent a brief, non-specific warning.<\/p>\n

\u201cOur sensors fired in real time when the actor escalated privileges,\u201d BeyondTrust wrote in the blog. The built-in triage tool in its third-party detection platform then closed those alerts as false positives, the company said, without naming the vendor. BeyondTrust said it contained the hosted instance 27 minutes after identifying it and is working with the vendor, so automated triage cannot close high-severity signals on its own.<\/p>\n

Neither company has said whether other customers were compromised.<\/p>\n

Root, persistence, and log wiping<\/h2>\n

About 11 minutes after the first malicious request, a PHP web shell Mandiant calls SAWFLY appeared in the appliance\u2019s web root, Google said in the blog post.<\/p>\n

To escalate from SAWFLY\u2019s unprivileged service account, the actor copied \/bin\/sh to \/usr\/bin\/dbus-authd, made root its owner, and set the SUID bit, Mandiant said. It then planted a startup script that writes a passwordless sudo entry into BeyondTrust\u2019s sudoers template, so the access survives reboots and configuration resets.<\/p>\n

According to the blog post, the actor also tried several variations of bt-secrets, a proprietary BeyondTrust command-line utility, to dump the appliance\u2019s credential vault. It later deleted more than a dozen system, web server, and application logs.<\/p>\n

Turning the help desk tool against its owner<\/h2>\n

In the blog post Mandiant added that the attacker raised the account\u2019s Jump Item and Team permissions from No Access to Administrator using a compromised administrator account.<\/p>\n

\u201cThis configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance\u2019s Jump Item list,\u201d the blog post added.<\/p>\n

It also deployed BARECLAW, a custom SOCKS5 tunneler, and edited the appliance\u2019s HAProxy configuration to route traffic to it through a hidden local listener, the post noted.<\/p>\n

SaaS customers are not off the hook<\/h2>\n

BeyondTrust said SaaS instances of Remote Support and Privileged Remote Access were patched automatically and that those customers need take no further action. Mandiant\u2019s report dates the SaaS rollout to Oct. 9 and says its credential rotation and configuration review steps still apply to SaaS customers.<\/p>\n

Self-hosted appliances on version 24.3.1 or later can apply the BT26-05-RS patch from the \/appliance interface, Mandiant said. Older versions must first be upgraded, and upgrading does not remediate prior exposure. BeyondTrust also patched Privileged Remote Access, which shares the affected code, though it found no way to exploit PRA.<\/p>\n

\u201cAny appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed,\u201d Mandiant said in the post.<\/p>\n

Because customers cannot audit the appliance\u2019s host file system, Mandiant recommends snapshotting suspect appliances before any reboot and rebuilding compromised ones from a clean image. It advises rotating credentials only after patching, so new secrets do not land on a box the attacker still controls.<\/p>\n

Same group, same playbook<\/h2>\n

GTIG said ARMORY CASTLE has been active since at least October 2023 and assessed with high confidence that it will keep exploiting edge device zero-days. BeyondTrust said CrowdStrike tracks the same cluster as WARP PANDA.<\/p>\n

\u201cIt is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764,\u201d Mandiant said in the post.<\/p>\n

GTIG compared the risk to 2024, when the group moved to mass exploitation after Ivanti Connect Secure flaws were disclosed. In 2025, it turned an Ivanti patch<\/a> into a working exploit. BeyondTrust said it suspects, without forensic proof, that the actor uses AI to model the products it targets, echoing a GTIG finding<\/a> that attackers are weaponizing newly disclosed flaws faster. <\/p>\n

BT26-05 is BeyondTrust\u2019s third critical-rated Remote Support advisory this year, according to its advisory index. In February, CVE-2026-1731<\/a> came under active attack shortly after disclosure, and CISA added it to its Known Exploited Vulnerabilities catalog.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group. \u201cOrganizations should prepare for potential widespread exploitation following this disclosure,\u201d Google […]<\/p>\n","protected":false},"author":0,"featured_media":10027,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10026"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10026"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10026\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10027"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}