Critical BeyondTrust Remote Support Vulnerability Exploited in the Wild by ARMORY CASTLE
Do Son 
TL;DR
BeyondTrust disclosed a critical BeyondTrust Remote Support vulnerability (CVE-2026-102764) on October 15, 2026, that is actively exploited in the wild. Suspected PRC-nexus espionage actors tracked as ARMORY CASTLE abused this flaw as a zero-day starting in late August 2026 to deploy custom malware and steal credentials. Organizations running self-hosted appliances must apply the BT26-05 security patch immediately and hunt for signs of compromise.
- CVE: CVE-2026-102764
- CVSS: 9.3 (Critical · CVSSv4)
- Product: BeyondTrust Remote Support
- Affected: ≤ 26.2.3
- Impact: Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
- Status: Exploited in the wild
- Action: See vendor advisory
Why It Matters
BeyondTrust Remote Support is an enterprise remote access solution that allows IT teams to troubleshoot endpoints. According to industry reports, BeyondTrust provides identity and remote access services to over 20,000 customers worldwide, including 75% of Fortune 100 companies.
Active exploitation of this BeyondTrust Remote Support vulnerability in the wild puts entire corporate networks at severe risk. During an incident response investigation, Mandiant and the Google Threat Intelligence Group (GTIG) discovered that ARMORY CASTLE (formerly UNC5221) exploited CVE-2026-102764 as a zero-day in late August 2026. Although no public proof-of-concept exists, GTIG warns that “Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public.” Earlier in 2024, the same threat group conducted mass exploitation of Ivanti flaws CVE-2023-46805 and CVE-2024-21887 shortly after public disclosure.
How the Attack Works
Tracked as CVE-2026-102764 (CVSS v3.1: 9.1, CVSS v4.0: 9.3), the flaw stems from internal components failing to validate the origin of received messages. Consequently, unauthenticated remote attackers can perform arbitrary file operations and upload malicious files to the appliance.
Initial Foothold and Privilege Escalation
Following initial exploitation, the attackers sent HTTP POST requests to stage the SAWFLY webshell (mangoapi.php). SAWFLY is a lightweight PHP webshell that uses Base32 encoding and a 256-bit RC4 stream cipher for encrypted command-and-control (C2) communications. If a request lacks the specific parameter c94mfe, the script returns a 404 error to evade scanners.
Because the webshell ran under an unprivileged site service account, the attackers escalated privileges by copying /bin/sh to /usr/bin/dbus-authd. They changed the file ownership to root and enabled Set User ID (SUID) permissions. As GTIG notes, “After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.”
Persistence, Vault Extraction, and BARECLAW Tunneling
Next, the actors ran the proprietary /ns/sbin/bt-secrets CLI utility to dump passwords, API keys, and administrative credentials from the appliance’s native vault. For long-term persistence, they created a startup script named zz-root-persist inside /home/bomgar/sbin/post_boot.d. This script appended passwordless sudo privileges to /ns/config/sudoers.template and executed bt-sysconfig to rebuild the active sudoers configuration across reboots.
With stolen administrator credentials, the attackers logged into the web portal and upgraded Jump Item permissions from No Access to Administrator. They then connected to internal endpoints and used native file transfer tools to exfiltrate sensitive IT documents.
Furthermore, the attackers deployed BARECLAW, a C-based SOCKS5 proxy tunneler carried over WebSockets. They modified /ns/config/haproxy.conf to route incoming traffic matching the /uidchanarge URI path directly to BARECLAW listening locally on TCP port 19800. Throughout the intrusion, the operators routinely deleted system, web, and bt-secrets logs to cover their tracks.
Affected Versions
This BeyondTrust Remote Support vulnerability affects all supported Remote Support versions up to and including 26.2.3. In its advisory, GTIG states that “Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.”
Patch and Mitigation Steps
BeyondTrust patched all Remote Support SaaS tenants on October 9, 2026. According to the official BeyondTrust BT26-05 security advisory, self-hosted customers running version 24.3.1 or later must immediately apply the BT26-05-RS patch via the /appliance interface. Operators running versions older than 24.3.1 must upgrade to a supported release before applying the patch.
If an appliance shows signs of compromise, defenders should take a memory and disk snapshot, block inbound traffic at the perimeter firewall, and redeploy the appliance from a clean image. Finally, after patching or rebuilding, administrators must terminate active sessions, rotate all stored or brokered credentials, and forward appliance syslog data to an external SIEM.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
