Science & Tech · Cybersecurity · 1 hr ago
China-linked group exploited critical BeyondTrust flaw since August
A suspected China-backed group exploited a critical flaw in BeyondTrust Remote Support appliances, with attacks observed since August.
The vulnerability, known as CVE-2026-102764, affected Remote Support version 26.2.3 and earlier and allowed remote attackers to carry out file operations without authentication.
BeyondTrust released a patch on October 8 for cloud and self-hosted customers, then publicly disclosed the flaw on October 15.
The attackers gained root-level control of compromised appliances, installed tools to maintain access and move through victim networks, and tried to steal stored credentials.
They also changed permissions to enable remote access to systems connected through the appliances and deleted logs to hinder detection.
Customers should patch affected systems immediately, and appliances exposed online while vulnerable should be treated as potentially compromised until reviewed.
Google warned that broader exploitation could follow public disclosure, but the number of affected or compromised systems is not known.
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability in attacks beginning in late August 2026.
Google and Mandiant identified the group as Armory Castle, also tracked by CrowdStrike as Warp Panda.
The vulnerability, CVE-2026-102764, is an authentication bypass that can let remote attackers perform file operations on unpatched appliances.
BeyondTrust released a patch on October 8 and publicly disclosed the flaw on October 15.
Researchers said attackers gained root access, deployed malware and sought to maintain access and move through victims’ networks.
- Who
- Armory Castle, a suspected China-linked espionage actor; CrowdStrike tracks it as Warp Panda.
- What
- The group exploited CVE-2026-102764 in BeyondTrust Remote Support appliances to gain access and establish persistence.
- When
- Attacks began in late August 2026. BeyondTrust released a patch on October 8 and disclosed the flaw on October 15.
- Where
- On vulnerable BeyondTrust Remote Support appliances; the sources do not identify specific victims.
- Why
- The sources describe the activity as espionage and long-term intelligence collection on behalf of China.
This story does not have two clearly opposing sides.
Armory Castle began exploiting the BeyondTrust vulnerability in zero-day attacks.
BeyondTrust released a patch for Remote Support and Privileged Remote Access SaaS customers.
BeyondTrust publicly disclosed the vulnerability, and Google published a warning about the attacks.
- Vulnerability
- CVE-2026-102764
- Severity
- CVSS rating of 9.3
- Affected software
- BeyondTrust Remote Support version 26.2.3 or earlier
- Patch date
- October 8, 2026
- Exposed instances
- Shadowserver tracked over 1,400 BeyondTrust Remote Support instances exposed online
- Threat actor aliases
- Armory Castle; Warp Panda; formerly UNC5221
3 sources
What people are saying
Organizations should prepare for potential widespread exploitation following this disclosure, as Armory Castle and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public
Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.