BeyondTrust says attackers have been exploiting a critical flaw in its Remote Support appliances since late August, and customers need to patch affected systems. The bug, CVE-2026-102764, is an authentication bypass affecting Remote Support 26.2.3 and earlier that lets a remote attacker perform file operations; Mandiant says the China-linked group Armory Castle (formerly UNC5221, also called Warp Panda) used it for initial access, then escalated to root, deployed Sawfly and Bareclaw malware, wiped logs, and moved laterally with stolen administrator credentials.
Why it matters: Organizations using internet-exposed BeyondTrust Remote Support appliances could have had their support infrastructure and stored credentials compromised for weeks before a fix was available. This is urgent: patch immediately, investigate exposed appliances as potentially compromised, and review downstream credentials and remote sessions.
2026.10.16
98% relevant
This article is a direct report on the same event, adding attribution details that Mandiant, Google, and BeyondTrust link the exploitation to the China-linked espionage group Armory Castle/UNC5221, plus tradecraft details including privilege escalation, credential theft from the appliance, persistence that survives reboots and resets, and malware names Sawfly and Bareclaw.
Ionut Arghire
2026.10.16
98% relevant
This source directly updates the same event by adding that Armory Castle/UNC5221 exploited CVE-2026-102764 as a zero-day starting August 29, used the Sawfly webshell and Bareclaw tunneler, gained root on affected appliances, deleted logs, pivoted through compromised admin credentials, and exfiltrated files via BeyondTrust’s native file-transfer service.
info@thehackernews.com (The Hacker News)
2026.10.16
95% relevant
This article appears to be a direct report on the same underlying event: a China-linked actor exploiting the BeyondTrust Remote Support zero-day CVE-2026-102764 to compromise Remote Support appliances/servers. It reinforces the attribution and exploitation details rather than describing a separate incident.
Sergiu Gatlan
2026.10.16
100% relevant
This article establishes a distinct new event: active exploitation and patching of CVE-2026-102764 in BeyondTrust Remote Support, with specific threat-actor attribution and post-exploitation details not covered by an existing tracked story.
← Back to all stories