A Chinese state-linked hacking group broke into BeyondTrust Remote Support appliances using a previously unknown security flaw, weeks before the company or its customers realized anything was wrong, according to incident reports published this week by BeyondTrust, Google’s Mandiant unit and the Google Threat Intelligence Group (GTIG).
BeyondTrust Remote Support (formerly sold as Bomgar) is software that IT help desks use to connect into employee or customer computers from a distance to fix problems. Because it is built to grant deep, trusted access into a network, a flaw in the tool itself is especially valuable to an attacker.
The vulnerability, tracked as CVE-2026-102764 and rated 9.3 out of 10 in severity, is an improper origin validation bug in an internal messaging component of the appliance. Exploiting it let an attacker carry out file operations on the device under the right conditions, which investigators say opened the door to full administrative control.
How the attack unfolded
According to BeyondTrust’s own timeline, the attackers first exploited the flaw as a zero-day, meaning before any patch existed, on a single self-hosted appliance on August 29, 2026. The activity only came to light after a separate incident at another security vendor became public on September 27, which prompted BeyondTrust to search its own systems for similar signs of compromise.
Mandiant’s analysis describes a methodical intrusion. The attacker deployed a lightweight web shell the researchers named SAWFLY to maintain remote access, routing traffic through commercial VPN services and compromised home and small-office routers to obscure its origin. Investigators say the group escalated to full administrative control by copying a system file to a new location and granting it root-level permissions, a technique that let the access survive device reboots.
From there, the attackers reportedly used BeyondTrust’s own internal tools to pull credentials stored in the appliance’s secrets database, then used stolen administrator credentials to reach other systems the appliance had access to and collect files for network reconnaissance. Mandiant said the group also ran a custom proxy tool called BARECLAW to tunnel traffic, and deleted system, web server and application logs in an apparent attempt to cover its tracks.
Who is behind it
BeyondTrust and Mandiant attribute the activity to a group they track as Armory Castle, also known in the security industry as UNC5221 or Warp Panda. The companies assess it as a Chinese state-sponsored espionage operation that has been active since at least October 2023, with a track record of targeting legal services firms, SaaS providers, outsourcing companies, technology vendors and government agencies for long-term intelligence collection rather than quick financial gain.
The same group has previously been linked to zero-day exploitation of Citrix and Ivanti products, including CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282, and to a backdoor called BRICKSTORM that US agencies warned about in 2025. Researchers at Google say the group tends to use a zero-day sparingly against chosen targets at first, with broader, less selective exploitation typically following once the flaw becomes public knowledge, and they believe wider exploitation of this BeyondTrust flaw is possible now that details are out.
What has been fixed, and what to do
BeyondTrust says cloud-hosted (SaaS) customers were already patched as of October 9, 2026. Organizations running the software on their own servers need to apply the BT26-05-RS patch if they are on version 24.3.1 through 26.2.3. Anyone on an older version has to upgrade first before the patch can be applied.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on October 16 and is requiring federal civilian agencies to apply the fix by October 19, 2026. CISA is also advising affected organizations to limit internet exposure of these appliances to only what is necessary, check logs and memory for signs of compromise, and treat any appliance that was reachable from the internet on a vulnerable version during the exploitation window as potentially compromised until it has been reviewed. Mandiant gave similar advice, recommending organizations rebuild affected appliances from a known-good state and then apply the patch, rather than simply patching in place.
No information has been published so far about how many organizations were actually compromised during the period before the flaw was discovered, and BeyondTrust has not said whether the attacker’s access to the single appliance it has confirmed led to further compromise of that customer’s network.
Source: The Hacker News and The Record
