BeyondTrust Remote Support CVE-2026-102764: Zero-Day Exploited by a China-Nexus Actor, Patch and Hunt Now

This was a zero-day. BeyondTrust says a suspected China-nexus espionage actor exploited it on 29 August 2026 against one BeyondTrust-hosted instance and one self-hosted appliance. BeyondTrust and Mandiant attribute the activity, with moderate to high confidence, to the group Mandiant now calls ARMORY CASTLE (previously UNC5221, the group behind earlier Ivanti Connect Secure and Citrix NetScaler zero-days). CrowdStrike tracks the same cluster as WARP PANDA.

BeyondTrust and Mandiant both warn that this actor tends to switch from careful, targeted use of a zero-day to broad exploitation of every unpatched instance once a flaw is public. Disclosure happened on 15 October, so self-hosted appliances that are still unpatched should be treated as at risk from today.

What is affected

Self-hosted appliances subscribed to automatic updates may already have the patch. Check rather than assume.

What we know about the attacks

BeyondTrust has withheld technical details while customers patch, and so do we. From BeyondTrust’s own investigation, which it says matches Mandiant’s findings, the actor:

• planted a web shell and worked through it interactively over the appliance’s own web server;
• connected through commercial VPN exits and compromised home and small-office routers, so traffic looked like ordinary broadband;
• reached full administrative control of the appliance within minutes and set up persistence designed to survive a reboot;
• read the appliance’s stored secrets and used its administrative access to reach downstream systems;
• deleted logs and its own tools before leaving.

That last point matters most for defenders. Logs kept only on the appliance may be gone or altered. Copies sent off the box are what you can trust.

What to do, in order

1. Find every appliance. List all self-hosted Remote Support and Privileged Remote Access appliances, including test and disaster-recovery ones, and note their versions and which interfaces are reachable from the internet.
2. Patch now. Apply the BT26-05 patch to every self-hosted Remote Support appliance on 24.3.1 to 26.2.3. Upgrade anything older than 24.3.1 to a supported version, then apply the patch. Apply the precautionary patch to Privileged Remote Access too.
3. Cut exposure. Expose only the parts of the appliance your users and customers genuinely need. Restrict administrative interfaces to trusted networks, and allow outbound traffic only to the destinations the appliance needs.
4. Get logs off the box. Forward appliance syslog and session events to your SIEM in near real time, if you are not already doing so. For any investigation, rely on those off-box records and external control planes.
5. Hunt for behaviour, not just indicators. The actor changes infrastructure and tooling for each victim, so look for:
   • privileged or administrative sessions from residential broadband or commercial VPN addresses you cannot tie to a known administrator or change ticket;
   • unfamiliar script files in web directories, and the web service account spawning shells;
   • unexpected account, permission or session-policy changes, especially to Jump Items or Teams;
   • gaps in log forwarding that start and end within a single session.

   Use Mandiant’s published indicators and YARA rules alongside these hunts. BeyondTrust customers can also request BeyondTrust’s threat-hunting package through its trust portal.

6. If you find anything, assume brokered credentials are exposed. Image the appliance before rebuilding it. Rotate every credential the appliance stored or injected, watch for those accounts signing in outside managed sessions or from unfamiliar places, and review new multi-factor registrations on privileged accounts. BeyondTrust asks customers with evidence of exploitation to open a Sev 1 support request citing BT26-05.

What this tells us about defence

BeyondTrust’s write-up is candid about one lesson: its sensors did fire when the actor escalated privileges, but an automated triage layer in a third-party detection platform closed those alerts as false positives. The intrusion was found by a separate, intelligence-led hunt. Two takeaways apply well beyond BeyondTrust customers:

• Treat an automated triage verdict as one input, and keep alerts it closes within scope for hunting, especially high-severity ones.
• Run threat hunts on their own schedule, driven by new threat intelligence, not only when an alert fires.

How a penetration test helps

Remote access and privileged access tools are high-value targets because one appliance can reach so much of an estate. An external attack-surface review shows which management and support interfaces are actually reachable from the internet. An internal assessment checks how far an attacker could move if the appliance and its stored credentials were compromised, and whether your logging would show it. PoCForge does not publish or use exploit code for this issue outside authorised engagements.

Sources

• BeyondTrust security advisory BT26-05 (15 October 2026): https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
• BeyondTrust, “ARMORY CASTLE and BT26-05: What Security Teams Need to Know” (15 October 2026): https://www.beyondtrust.com/blog/entry/bt26-05
• Mandiant / Google Threat Intelligence Group, “ARMORY CASTLE Exploits BeyondTrust” (15 October 2026): https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-102764
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102764

PoCForge publishes offensive-security research to explain attack paths and defensive controls. This article summarises public advisories only; it is not an exploit guide and does not describe a named client engagement.