BeyondTrust Remote Support Zero Day Exploited by Suspected Chinese Espionage Crew
This is an update to VTA-2026-000079, published on 2026-02-09, which covered zero-day exploitation of BeyondTrust remote access products. The incident has since moved on in a material way: a new and separate critical zero-day, CVE-2026-102764, has been disclosed in BeyondTrust Remote Support, and exploitation of it has been attributed to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221 and tracked by CrowdStrike as WARP PANDA. The flaw scores 9.3 on CVSS 4.0 and affects Remote Support versions up to 26.2.3; BeyondTrust published advisory BT26-05 and had already shipped a patch on 8 October, while withholding technical detail about the bug itself. An unauthenticated attacker can abuse it to perform file operations on the appliance, leading to host-level control and access to every credential the appliance stores or brokers. The vendor's timeline places first exploitation on 29 August against one BeyondTrust-hosted instance and one self-hosted appliance, with the intrusion only identified on 28 September.
The post-exploitation chain is well documented even though the vulnerability mechanics are not. Roughly eleven minutes after the first malicious request, a PHP web shell tracked as SAWFLY was dropped into the appliance's web root, giving the actor command execution under an unprivileged service account. Escalation was achieved by copying /bin/sh to /usr/bin/dbus-authd, changing its owner to root and setting the SUID bit, followed by a startup script that writes a passwordless sudo entry into BeyondTrust's sudoers template so the access survives reboots and configuration resets. The actor then ran several variations of bt-secrets, a proprietary BeyondTrust command-line utility, in an attempt to dump the appliance's credential vault, and later deleted more than a dozen system, web server and application logs. Using a compromised administrator account, Jump Item and Team permissions were raised from No Access to Administrator, granting unrestricted authority to launch remote sessions into downstream systems, while a custom SOCKS5 tunneler named BARECLAW was deployed and the appliance's HAProxy configuration edited to route traffic to it through a hidden local listener.
CVE-2026-102764 is confirmed exploited in the wild and was added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-16; FIRST EPSS currently puts the probability of exploitation in the next 30 days at 0.6 percent, a figure that reflects the targeted nature of the activity so far rather than any safety margin. The exposure is significant because Remote Support is a privileged help desk platform that holds and brokers credentials for the systems it manages, so a single compromised appliance translates directly into credential access and a ready-made path for lateral movement into downstream estates. The intrusion also went undetected for a month: BeyondTrust says its sensors fired in real time when the actor escalated privileges, but the built-in triage tool in an unnamed third-party detection platform closed those alerts as false positives, and the hosted instance was contained only 27 minutes after it was finally identified. Neither BeyondTrust nor the responders have said whether other customers were compromised, and any internet-reachable appliance running a vulnerable version during the exploitation window is considered potentially affected. SaaS instances of Remote Support and Privileged Remote Access were patched automatically on 9 October, and Privileged Remote Access, which shares the affected code, was patched as well although no exploit path was found for it. The wider concern is repetition: the same actor has been active since at least October 2023, moved to mass exploitation after Ivanti Connect Secure flaws were disclosed in 2024, and turned an Ivanti patch into a working exploit in 2025, with widespread exploitation of this flaw assessed as likely now that it is public. BeyondTrust further suspects, without forensic proof, that the actor uses AI to model the products it targets. For context, the earlier Remote Support flaw CVE-2026-1731 was added to CISA KEV on 2026-02-13, has known use in ransomware campaigns, and carries an EPSS probability of 92.5 percent.
Attack Surface
Remote Access Service, System Management Service, Cloud Service
Tactics
Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Lateral Movement, Command and Control
Techniques
- T1190 – Exploit Public-Facing Application
- T1505.003 – Server Software Component: Web Shell
- T1548.001 – Abuse Elevation Control Mechanism: Setuid and Setgid
- T1548.003 – Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1555 – Credentials from Password Stores
- T1098 – Account Manipulation
- T1070.002 – Indicator Removal: Clear Linux or Mac System Logs
- T1572 – Protocol Tunneling
- T1021 – Remote Services
SuperPRO's Threat Countermeasures Procedures
- Apply the BT26-05-RS patch from the /appliance interface on self-hosted BeyondTrust Remote Support running 24.3.1 or later; appliances on older builds up to 26.2.3 must be upgraded first, and note that upgrading alone does not remediate prior exposure to CVE-2026-102764.
- Treat any Remote Support appliance that was internet-reachable on a vulnerable version between 29 August 2026 and patching as potentially compromised: snapshot the appliance before any reboot, and rebuild confirmed-compromised units from a clean image rather than cleaning in place.
- Hunt the appliance for the documented persistence artefacts – a root-owned SUID copy of /bin/sh at /usr/bin/dbus-authd, startup scripts that inject a passwordless sudo entry into the BeyondTrust sudoers template, and unexpected PHP files in the web root matching the SAWFLY web shell.
- Alert on execution of the bt-secrets utility and on bulk deletion of system, web server and application logs on the appliance, both of which were used in this intrusion for credential vault dumping and anti-forensics.
- Audit the HAProxy configuration for unauthorised backends or hidden local listeners used to front the BARECLAW SOCKS5 tunneler, and review Jump Item and Team permissions for accounts changed from No Access to Administrator.
- Rotate every credential the appliance stores or brokers – vault secrets, administrator accounts, Jump Item credentials and downstream service accounts – only after the BT26-05 patch is applied, so new secrets are not issued onto a host still under attacker control; this step also applies to SaaS Remote Support and Privileged Remote Access tenants patched on 9 October.
- Disable automatic closure of high-severity privilege-escalation alerts by the built-in triage automation in your EDR or detection platform, and retrospectively re-open any such alerts auto-closed as false positives on BeyondTrust appliances since late August; also confirm CVE-2026-1731 (CISA KEV, 2026-02-13, ransomware-linked) is remediated on the same estate.
