BeyondTrust Remote Support Zero-Day Exploited
A BeyondTrust Remote Support zero-day has been exploited since August 29, and CISA added it to the Known Exploited Vulnerabilities catalog on October 16. Google’s Mandiant ties the attacks to Armory Castle, a China-linked espionage group, and says any internet-reachable appliance on a vulnerable version should be treated as potentially compromised until it has been reviewed.
What Happened
BeyondTrust published advisory BT26-05 on October 15. The flaw, CVE-2026-102764 (CVSS 9.3), is an improper validation of message origins in an internal messaging component. A remote attacker can use it to perform file operations on the appliance. This BeyondTrust Remote Support zero-day affects every release up to and including 26.2.3. BeyondTrust’s timeline puts the first exploitation on August 29; reports differ on whether one or two appliances were hit that day. BeyondTrust found the defect on September 28, a day after exploitation against another security device provider became public. It had a patch by September 30 and shipped it on October 8 after closing additional exploitation paths. SaaS customers were patched as of October 9. Self-hosted customers on 24.3.1 through 26.2.3 need the BT26-05-RS patch; older versions must upgrade first. Germany’s BSI published a warning on October 15.
Mandiant and Google Threat Intelligence describe what followed: a lightweight PHP web shell called SAWFLY, a SOCKS5 tunneler called BARECLAW, root access through a copy of the system shell, credential harvesting attempts against the appliance’s own secrets store, and deletion of system, web server and application logs. The attackers then used the appliance’s remote support functions to reach downstream systems and pulled software inventories from user desktops through the built-in file transfer service.
Why It Matters
A remote support appliance is a pre-approved path into every system it manages. Compromise it and the attacker inherits the access your support staff have, with sessions that look like normal helpdesk work. BeyondTrust’s own assessment is that the actor uses a zero-day selectively against chosen targets and moves to broad exploitation of every unpatched instance once the flaw is public, which is the situation as of October 19.
Armory Castle (also tracked as UNC5221 and Warp Panda) has a record with edge appliances: zero-days in Citrix NetScaler, Ivanti Connect Secure and Dell RecoverPoint. We covered the latest edge-device zero-days on Ivanti Connect Secure and Citrix NetScaler. We know of no German victims as of October 19. Assessment: IT service providers and mid-sized IT departments that run a self-hosted Remote Support appliance carry the exposure, and their customers inherit it.
What You Should Do Now
- Patch. Apply BT26-05-RS to self-hosted Remote Support 24.3.1 through 26.2.3; older versions must upgrade first. SaaS instances were patched by BeyondTrust as of October 9. CISA set a federal deadline of October 19.
- Decide whether to assume compromise. If the appliance was reachable from the internet on 26.2.3 or older at any point since late August, treat it as potentially compromised, as Mandiant advises. Restrict external access to the services you actually need.
- Hunt. Look for /usr/bin/dbus-authd (a root-owned copy of the shell with the SUID bit), unexpected changes to /ns/config/haproxy.conf, missing or truncated logs, administrator accounts or permissions you did not change, and remote sessions or file transfers to Jump Items that nobody started.
- Contain and rebuild. Take a snapshot or image first, isolate the appliance, rebuild from a known-good state with the patch applied, then rotate every credential and API key the appliance stored. Mandiant saw the attackers read that store.
DIESEC Perspective
The pattern across this month’s appliance zero-days is the same: patching comes first, but rotating credentials and rebuilding the appliance take most of the effort. Remote support tooling also belongs on your supplier checklist. Ask the providers that touch your network whether their appliance ran 26.2.3 or older this autumn.
Not sure whether your remote support appliance was exposed since August? Contact DIESEC for a rapid exposure and compromise assessment of your remote access appliances.
Sources: The Hacker News | SecurityWeek | BSI | Canadian Cyber Centre | BeyondTrust
Published: 2026-10-20 | Category: Nation-State & APT | ~4 min read
