Cybersecurity
BeyondTrust patches exploited Remote Support flaw
BeyondTrust said a flaw in Remote Support had been used in zero-day attacks since late August, and researchers linked the activity to Armory Castle while urging patching of self-hosted systems.
- BeyondTrust said CVE-2026-102764 affected Remote Support 26.2.3 and earlier, and allowed unauthorised remote attackers to perform file operations on unpatched appliances.
- The company said it had patched Remote Support and Privileged Remote Access SaaS customers on 8 October, while self-hosted installations needed manual updating if automatic patching was not enabled.
- Mandiant said it saw the first attacks in late August and linked them to Armory Castle, which other researchers also called UNC5221 and Warp Panda.
- Shadowserver said it was tracking more than 1,400 BeyondTrust Remote Support instances exposed on the internet.
- The article said Silk Typhoon had previously used two zero-days to compromise 17 Remote Support SaaS instances, including one at the U.S. Treasury Department, and had also targeted OFAC and CFIUS.
BeyondTrust told customers to install a fix for a Remote Support vulnerability that it said had already been used in attacks from late August. The company identified the issue as CVE-2026-102764 and said it affected RS 26.2.3 and earlier builds.
The company said it had already patched Remote Support and Privileged Remote Access SaaS tenants on 8 October. It added that self-hosted systems needed manual patching when automatic updates were not turned on, and that its testing had not shown a way to exploit Privileged Remote Access directly.
Mandiant said it saw the first intrusions and tied them to Armory Castle, which it also linked with UNC5221 and Warp Panda. According to its account, the operators gained initial access, raised privileges, set SUID permissions, installed the Sawfly web shell and Bareclaw tunneller, removed logs and used stolen Administrator credentials to move across networks.
Shadowserver said it had found more than 1,400 BeyondTrust Remote Support instances reachable on the internet, but it did not say how many were already fixed or used as decoys. The article also said Silk Typhoon had previously used two zero-days to break into BeyondTrust systems, compromise 17 SaaS instances and target the U.S. Treasury Department, OFAC and CFIUS.
Named in this story
Companies
- BeyondTrust
- issued the patch warning and described the affected products
- Mandiant
- found the initial attacks and described the intrusion chain
- CrowdStrike
- tracked the same actor as Warp Panda
Organisations
- Google Threat Intelligence Group (GTIG)
- tracked the actor as Armory Castle
- Armory Castle
- the suspected China-nexus group linked to the exploitation
- UNC5221
- the earlier name for Armory Castle
- Warp Panda
- CrowdStrike's name for Armory Castle
- Shadowserver
- reported more than 1,400 exposed instances
- Silk Typhoon
- the group believed to have used earlier BeyondTrust zero-days
Governments and agencies
- Office of Foreign Assets Control (OFAC)
- one of Silk Typhoon's later targets
- Committee on Foreign Investment in the United States (CFIUS)
- one of Silk Typhoon's later targets
- U.S. Treasury Department
- its instance was said to have been compromised
Products and systems
- Remote Support
- the enterprise support product affected by the flaw
- Privileged Remote Access
- the related product that shared affected code
- Sawfly
- the web shell the attackers deployed
- Bareclaw
- the tunneller malware the attackers deployed
How the source tells it
The register was urgent and alarmed, driven by exploit warnings and worst-case guidance, though the attribution of the attacker stayed cautious.
- urgency imperative patch warning and immediate-update recommendations
- alarm severity labels, active-exploitation claims and potential-compromise language
- threat escalation worst-case guidance and forecasts of wider attacks