A group of China-linked hackers exploited a previously unknown security vulnerability in BeyondTrust Remote Support software to seize control of a self-hosted appliance on August 29, 2026, according to a security disclosure published by BeyondTrust in October 2026. The attackers, tracked by security researchers as Armory Castle, leveraged the zero-day flaw to execute file operations on the compromised system. BeyondTrust identified the breach following the public disclosure of a separate security device compromise on September 27, 2026, which prompted the company to launch an investigation hunting for similar intrusion patterns.
The vulnerability, designated CVE-2026-102764, resides in an internal messaging component that fails to validate the origin of incoming messages. A remote attacker can exploit this weakness by transmitting specially crafted messages to perform file operations on the appliance. Security analysts have assigned the flaw a CVSS severity score of 9.3, placing it in the critical risk category. BeyondTrust deployed patches to its Remote Support SaaS customers on October 9, 2026, while self-hosted customers running versions 24.3.1 through 26.2.3 must manually apply the BT26-05-RS patch. Organizations operating versions older than 24.3.1 need to upgrade to a newer release before they can install the fix.
The investigation confirmed that Armory Castle had exploited the zero-day on a single self-hosted appliance, according to the disclosure. Armory Castle has been active since October 2023 and has previously exploited zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure appliances. The group targets legal services firms, SaaS providers, business-process outsourcing companies, technology companies, and government agencies for long-term intelligence gathering. Mandiant and Google Threat Intelligence Group reported that after gaining initial access, the attackers deploy a lightweight PHP web shell named SAWFLY for interactive remote access and encrypted command-and-control communications.
Once inside the compromised system, the attackers employ sophisticated techniques to establish persistence and escalate privileges. They copy the system shell executable to /usr/bin/dbus-authd, assign root ownership, and enable the SUID bit to execute it with elevated privileges. The group then runs BeyondTrust's proprietary CLI tool bt-secrets to extract passwords and API keys from the appliance's secrets database, along with endpoint credentials. They modify BeyondTrust configuration templates to obtain passwordless root access to the site service account, then pivot into the Remote Support application to initiate sessions to downstream systems listed in the Jump Item list. By abusing administrative rights to open remote support sessions to internal endpoints, they gain complete file-system access to download and exfiltrate sensitive documents for network reconnaissance. The attackers also deploy a custom SOCKS5 proxy called BARECLAW to relay TCP connections between a remote client and internal destinations, modify the /ns/config/haproxy.conf file to make BARECLAW accessible from the internet, and delete system, web server, and application logs to evade detection.
BeyondTrust advises organizations to treat any internet-facing Remote Support appliance running a vulnerable version as potentially compromised until they've completed a thorough review. The company recommends applying the latest patch or upgrading to a supported version immediately. Organizations should limit exposure of the management interface to trusted networks only and monitor logs for unusual file operations or privileged command execution. The operators route traffic through commercial VPN exit nodes and compromised home or small-office routers to blend with legitimate traffic, making detection particularly challenging. Remote access platforms have become high-value targets for state-sponsored groups seeking persistent footholds in corporate networks, and the sophistication of Armory Castle's tradecraft suggests organizations face adversaries who invest heavily in understanding the architecture of widely deployed enterprise tools.