The support tool that held the keys

The US Cybersecurity and Infrastructure Security Agency added a flaw in BeyondTrust's Remote Support appliances to its Known Exploited Vulnerabilities catalogue on Friday and gave federal civilian agencies until Monday, 19 October, to act on it. By our count that is three days. The entry, for CVE-2026-102764, describes "an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance". It is flagged for forensic triage, and the required action points agencies to CISA's forensics triage requirements under Binding Operational Directive 26-04 as well as the vendor's fixes.

The listing follows a report published on Thursday by Google's Threat Intelligence Group and Mandiant, which said a suspected China-nexus espionage actor it calls Armory Castle, formerly tracked as UNC5221, exploited the flaw as a zero-day in late August. Google said the bug affects all supported Remote Support versions up to 26.2.3 and lets an unauthenticated attacker perform file operations "which can lead to host-level control and access to every credential the appliance stores or brokers". SecurityWeek reported a severity score of 9.3 and said the group is also tracked as Warp Panda.

The accounts of the timeline do not line up exactly. Google gives only "late August" for the first exploitation. SecurityWeek put it on 29 August, against one BeyondTrust-hosted and one self-hosted appliance, and said BeyondTrust identified the defect on 28 September, produced a patch by 30 September and, after further testing and work on other exploitation paths, shipped the fix on 8 October. Google says BeyondTrust applied the patch to all Remote Support SaaS tenants on 9 October, and Cybersecurity Dive gave 9 October as the date BeyondTrust issued it. We were unable to open BeyondTrust's own advisory, BT26-05, which returned an access error.

Google's description of the intrusion is specific. Around 11 minutes after the group's first request following exploitation, a PHP webshell it calls Sawfly appeared in the appliance's web root; a second tool, Bareclaw, carried a SOCKS5 proxy over WebSocket into the victim's network. The attacker then used the appliance's own command-line utility for managing stored passwords and API keys to pull credentials from its vault, and routinely deleted logs. SecurityWeek said the attackers used the product's native file-transfer service to download internal documents such as software inventories.

How many organisations were hit is not known, and none has been named. "We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure," Kelli Vanderlee, a senior analyst at Google's threat intelligence group, told Cybersecurity Dive. The outlet said the activity was found in late September while Mandiant was investigating a separate zero-day, and that Mandiant alerted BeyondTrust, which found an affected SaaS instance.

The remediation falls on self-hosted customers. Google advises applying the BT26-05-RS patch on version 24.3.1 or later and upgrading older appliances first, noting that upgrading "closes the vulnerability but does not remediate prior exposure". It says: "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." For appliances with confirmed or unknown compromise, the report advises redeploying from a clean, fully patched image rather than cleaning them, because host-level persistence survives reboots and configuration resets, and then rotating stored credentials in a set order.

Google says Armory Castle has been active since at least October 2023 and has previously exploited several edge appliances. SecurityWeek listed earlier zero-days attributed to the group in Citrix NetScaler, known as CitrixBleed, Ivanti Connect Secure and Dell RecoverPoint for Virtual Machines. "Armory Castle is a prime example of why edge and remote access technology remains some of the most valuable targets for nation-state operators," Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive. "They sit at the boundary of the enterprise while holding privileged access to what lies behind it."

It is the second BeyondTrust Remote Support flaw on CISA's list this year. The catalogue shows CVE-2026-1731, a command-injection bug in Remote Support and Privileged Remote Access, added on Friday, 13 February with a deadline of Monday, 16 February, and marks it as known to have been used in ransomware campaigns. No source we read connects that flaw to Armory Castle. For this one, the catalogue lists ransomware use as unknown.

Remote-support tools are built to reach deep into other machines, which is what makes a compromised one valuable. Komposite reported this week on an Ivanti VPN chain that gave root on fully patched devices and on an exploited root flaw in the PAN-OS management interface, which carried its own short CISA deadline.