Until proven otherwise, every self-hosted BeyondTrust Remote Support appliance should be viewed as compromised. A China-linked espionage outfit tracked as ARMORY CASTLE, also known as UNC5221 and Warp Panda, operated inside vulnerable systems for about a month through a zero-day, according to Mandiant and Google Threat Intelligence Group (GTIG).
Rated 9.3 under CVSS 4.0, the bug is CVE-2026-102764. BeyondTrust describes it as improper validation of message origins. File operations on a Remote Support appliance can be triggered by an unauthenticated intruder, and that access yields host-level control along with every credential the appliance holds or brokers.
Weeks of quiet access
First exploitation, per the vendor, landed on August 29 against two targets: one appliance hosted by BeyondTrust and one in a customer’s own environment. The defect was identified on September 28, with fixes shipped October 8 in the BT26-05-RS patch after additional testing sealed off other exploitation avenues.
The affected range runs through 26.2.3 inclusive. Any deployment below 24.3.1 needs a version upgrade before the patch can be applied.
Once inside, the crew deployed the Sawfly webshell and Bareclaw tunneler, escalated privileges, harvested credentials, and wiped system, web server and application logs before pivoting laterally with stolen administrator credentials.
Guidance for defenders
Intelligence teams expect broader exploitation now that the flaw is public, with full technical details withheld while customers patch. BeyondTrust’s SaaS fleet was remediated on October 9, leaving self-hosted operators exposed. Treat every internet-facing appliance as a potential beachhead: rotate vault credentials, hunt for lateral movement, and scan logs for gaps intruders may have carved out.
