Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

What it is

CVE-2026-102764 (CVSS 9.3) is an improper validation of message origins flaw in BeyondTrust Remote Support (RS) appliances that lets an attacker perform file operations on the appliance. Mandiant and GTIG attribute zero-day exploitation to Armory Castle (also tracked as UNC5221 and Warp Panda), a China-linked espionage group.

How it works

The page gives the flaw only as "improper validation of message origins" and says nothing deeper about the bug. It does describe the intrusion that followed:

1. Initial access through the RS appliance, with the Sawfly PHP webshell as the primary foothold. Sawfly uses bidirectional encrypted C&C.
2. Root-level control of the appliance host, credential harvesting, and passwordless root for the site service account.
3. Systematic deletion of system, web server, and application-level logs.
4. A pivot into the RS application using compromised administrator credentials. The actor changed that account's permissions to gain control of remote systems.
5. Use of the appliance's built-in support tools to obtain full file-system access on endpoints. Files such as software inventories were pulled from user desktops through the native RS file transfer service.
6. The Bareclaw SOCKS5 tunneler, which supports encryption, upstream proxy chaining and authentication.

Preconditions / Affected

• All RS versions up to and including 26.2.3 are affected.
• Exposure timeline: first exploitation was August 29, against one BeyondTrust-hosted and one self-hosted appliance. BeyondTrust identified the flaw September 28 and had a patch by September 30. It shipped October 8 after further testing and fixes for additional exploitation paths.
• SaaS customers were patched as of October 9, 2026. Self-hosted customers are responsible for their own patching.

What to do

• Apply patch BT26-05-RS. It covers versions 24.3.1 through 26.2.3.
• On releases older than 24.3.1, upgrade to a newer version first, then apply the patch.
• Self-hosted customers without automatic updates must apply the patch manually.
• Because exploitation began about six weeks before the fix shipped, patching alone does not clear a prior compromise. Based on the observed behavior, review the following on self-hosted appliances:
• PHP webshells on the appliance, and outbound SOCKS5 tunneling.
• Unexpected permission changes on RS administrator accounts.
• File transfer sessions that pulled documents from user desktops.
• Gaps in system, web server, or application logs, since the actor deleted them. Off-box log copies matter here.
• Rotate credentials that were reachable from the appliance, including administrator and the site service account. This follows from the credential harvesting the page reports.

Caveats

• The page publishes no IOCs, file hashes, YARA rules or detection queries. The hunting ideas above are inferred from the described behavior, not given by the source.
• The page does not say how many organizations were hit. It names only the two initial victims and an earlier exploitation against "a security device provider".
• The page does not explain how the actor got from the origin validation flaw to code execution and root. The path from file operations to a webshell is not described.