BeyondTrust patches zero-day after Armory Castle steals credentials and persists in remote support appliances

Suspected Chinese state-sponsored attackers exploited a zero-day vulnerability in BeyondTrust remote support software to steal credentials and maintain persistent access to victim networks.

The threat group, identified by Mandiant as Armory Castle or UNC5221, leveraged the flaw in BeyondTrust’s Remote Support appliances to escalate privileges and move laterally within compromised environments.

What we know

BeyondTrust, Mandiant and Google Threat Intelligence Group confirmed the exploitation on Thursday evening, publishing reports detailing the campaign. The vulnerability, tagged CVE-2026-102764, affects appliances that allow IT teams to securely access and troubleshoot remote endpoints.

Mandiant stated that the first known attack occurred on 29 August, nearly seven weeks before public disclosure. The group demonstrated a deep understanding of appliance internals, using custom malware named Sawfly and Bareclaw to facilitate the intrusion.

Attackers extracted every credential stored on the appliances and modified files in a way that survives reboots and configuration resets. This technique allowed them to sustain access even after standard remediation attempts.

BeyondTrust confirmed that Armory Castle is a Chinese state-sponsored espionage operation focused on long-term intelligence collection. The group has previously targeted legal services, SaaS providers, business-process outsourcers, technology companies and government entities.

Mandiant warned that any vulnerable appliance reachable from the internet should be treated as potentially compromised until thoroughly reviewed. The firm advised organisations to prepare for potential widespread exploitation, noting the group’s history of opportunistic attacks following public disclosures.

BeyondTrust released a patch for self-hosted customers on 8 October and automatically applied the update to cloud-based versions of the product on the same day. Several mitigations are also available for those unable to patch immediately.

Defender's checklist

• Verify whether your organisation uses BeyondTrust Remote Support appliances and check their internet exposure.
• Confirm that the patch released on 8 October has been applied to all self-hosted instances.
• Review logs for signs of privilege escalation or lateral movement following 29 August.
• Assume any internet-reachable appliance is compromised until a thorough forensic review is completed.

The background in plain language

Remote support appliances act as secure gateways for IT staff to fix issues on distant computers. When these devices are compromised, attackers gain a trusted foothold inside the network. Zero-day flaws are unknown vulnerabilities that vendors have not yet patched, giving attackers a window of opportunity. Credential theft allows spies to impersonate legitimate users, while persistence mechanisms ensure they remain inside even after system restarts. Teams usually monitor for unusual administrative activity and rotate passwords after such breaches to limit damage.

Background: Privilege escalation vulnerabilities

Detect privilege escalation by correlating authentication logs with file permission changes and process creation events. Look for unusual parent-child process relationships, unexpected service account usage and deviations from baseline behaviour. Use endpoint detection platforms to catch runtime anomalies that static scans miss.

Read the full guide: Detect Privilege Escalation: Signals, Tools and Blind Spots

What to do and how to stay safe: BeyondTrust

• Inventory all remote support appliances and ensure they are not directly accessible from the public internet.
• Apply the latest security updates provided by the vendor as soon as they become available.
• Monitor network traffic for unusual connections or data exfiltration from support devices.
• Rotate all credentials stored within or accessible via these appliances once the vendor provides an update.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this BeyondTrust vulnerability?

The vulnerability is identified as CVE-2026-102764.

Which threat group is responsible for these attacks?

Mandiant attributes the attacks to Armory Castle, also known as UNC5221, a suspected Chinese state-sponsored group.

Has a patch been released for this zero-day?

Yes, BeyondTrust released a patch for self-hosted customers on 8 October and updated cloud versions automatically.