- Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the public heard about it.
- The flaw, CVE-2026-102764, lets remote attackers run file actions on weak BeyondTrust Remote Support devices.
- BeyondTrust released a patch, but experts say users must still check for signs of a break-in.
A suspected China-linked spy group broke into BeyondTrust Remote Support servers before anyone knew about the flaw. Google Threat Intelligence Group (GTIG) and Mandiant shared their findings on October 15, 2026. The attackers took control of the devices and accessed sensitive login details. Experts now warn that installing the fix is only the first step.
Attackers Struck Weeks Before the Public Warning
Google and Mandiant call the group Armory Castle. Researchers earlier knew it as UNC5221. CrowdStrike tracks the same activity under the name Warp Panda.
China-linked cyber activity has also drawn attention in the Pacific region. US authorities have flagged suspected China-linked hackers in a breach involving a Pacific regional organization.
The flaw carries the label CVE-2026-102764. It is a zero-day, which means attackers used it before the maker could fix it. Researchers found signs that the group used it in late August. BeyondTrust told the public about the flaw weeks later.
BeyondTrust gave the flaw a CVSS score of 9.3. That score places it in the critical group. The problem comes from weak origin checks in an internal messaging part. According to the company’s security advisory, the party did not properly confirm where incoming messages came from. A remote attacker could then run file actions on the device.
BeyondTrust’s timeline marks August 29 as the day of the attack. Its own investigation gained speed after another security device maker reported attacks on September 27. The company then checked its systems and found suspicious activity. It was fixed soon after.
BeyondTrust posted its advisory on October 15. Google and Mandiant released their technical report the same day. The report explains how the attackers kept access, stole logins, and moved into linked systems.
Hidden Tools and Stolen Logins Gave Hackers Deeper Access
Mandiant says the attackers dropped a small PHP tool called SAWFLY after the break-in. This kind of tool is called a web shell. It gave them live remote access to the device. It also used coded messages to talk with the hacked machine.
Next, the attackers raised their privileges to root level, which is the highest level of control on a system. Researchers found that they copied the system shell file from /bin/sh to /usr/bin/dbus-authd. They changed its owner to root and turned on Set User ID (SUID) permissions. That setting lets the copied file run with the owner’s rights.
The group also tried to pull passwords, API keys, and endpoint logins. It aimed at BeyondTrust’s built-in secrets database and used its own command-line tool. Researchers say the attackers targeted setup templates to gain higher rights. They also used stolen admin logins to reach other systems through the remote support features.
Another tool, called BARECLAW, was a custom tunneler written in C. It passed network traffic through the hacked device. The attackers edited a setting file to open this tool to the internet. They also wiped system, web server, and app logs to avoid being caught.
Mandiant adds that the group worked hard to hide its traffic. It used commercial VPN exit points and hacked home and small office routers. The attackers also knew the inner parts of BeyondTrust products well. Together, these steps helped them stay inside and move through their targets.
BeyondTrust Releases a Fix and Urges Customers to Investigate
BeyondTrust says it fixed all Remote Support cloud customers by October 9, 2026. Self-hosted customers on versions 24.3.1 through 26.2.3 should install the BT26-05-RS patch if automatic updates have not done so. Customers on versions older than 24.3.1 must upgrade first. The company shared more details in its official blog post.
BeyondTrust also issued a precaution patch for Privileged Remote Access. That product shares the affected code. The company says its tests found no way to attack that product through this flaw.
Mandiant warns that some devices may already be hacked. Any device open to the internet on a weak version during the attack period should be treated as compromised. That label stays until investigators finish a full review. A patch closes the hole, but it does not show whether attackers got in earlier. It also does not remove traces of a break-in.
Armory Castle has a record of targeting business-facing systems. These include Citrix NetScaler and Ivanti Connect Secure. BeyondTrust notes that the group has changed tactics before. It moved from selective zero-day attacks to wider attacks once flaws became public.
So organizations should patch first. Then they should look for strange activity and check which logins may be exposed. They should also see whether attackers reached any linked systems. Each step helps teams learn what the hackers actually touched.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
French Police Shut Down Reacher and Stryx, Arrest Three 17-Year-Olds
French police arrested three 17-year-olds for allegedly operating the Reacher and Stryx stolen data ...
Privacy Concerns Grow Over Meta Muse Profiles of People Who Never Use the App
WIRED and independent researcher Karan Joshi report that Muse’s instructions tell it to build a page...
ICANN Switches DNS Root to KSK-2024 in Major Internet Security Update
The root zone KSK rollover took place on October 11, the second time since the first one nearly a de...
Florida Sues TP-Link Over Router Security Risks and Alleged China Links
Florida’s Attorney General James Uthmeier sued TP-Link, saying the company hid risks tied to i...
