China-nexus group steals admin credentials via BeyondTrust zero-day

The China-nexus group ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support to steal administrative credentials from appliance vaults starting August 29, 2026 ^[1][4].

The vulnerability allows unauthenticated remote attackers to gain host-level control over the appliance and access every credential the system stores or brokers ^[8]. Because Remote Support—a platform used for remotely troubleshooting and administering endpoints—acts as a privileged access broker, owning the appliance grants attackers both the vaulted credentials and the policy control to move into downstream systems ^[1][5].

ARMORY CASTLE exploits BeyondTrust zero-day

The attack targeted CVE-2026-102764, a flaw in BeyondTrust Remote Support (formerly known as Bomgar) versions 26.2.3 and earlier ^[1][5]. The vulnerability carries a CVSS score of 9.3 and was first used on August 29, 2026, against one self-hosted appliance and one BeyondTrust-hosted SaaS instance ^[4][5]. BeyondTrust discovered and contained the hosted compromise on September 28, while Mandiant shared corroborating findings from the self-hosted investigation on September 30 ^[5].

Google's Mandiant and BeyondTrust attribute the activity to ARMORY CASTLE, a suspected PRC-nexus espionage group previously tracked as UNC5221 ^[1][4]. BeyondTrust also notes the actor is tracked as Warp Panda ^[8].

Technical breakdown of breach and vault theft

The flaw, classified as authentication bypass by spoofing (CWE-290), stems from internal components that fail to adequately validate the origin of incoming messages ^[5][8]. According to BeyondTrust, this allows an unauthenticated remote attacker to perform file operations on the appliance ^[1].

According to Mandiant, the attackers used this access to deploy the SAWFLY PHP web shell and the BARECLAW tunneler ^[5]. After escalating privileges to root and creating a root SUID backdoor, the intruders used the bt-secrets tool to export all administrative credentials from the appliance vault ^[1][5].

Mandiant reported that the actor then logged in as an administrator to raise Jump Item and Team roles from "No Access" to "Administrator" ^[1]. This elevation allowed the attackers to reach downstream systems while appearing as normal brokered admin work ^[1]. Mandiant further noted that the actor engaged in log deletion and established persistence ^[5].

CISA intervention and patching requirements

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026 ^[1][2]. CISA set a remediation deadline of October 19 for U.S. federal agencies and required forensic triage—including network and memory forensics—for affected systems ^[2][4].

BeyondTrust has released the BT26-05-RS patch for versions 24.3.1 through 26.2.3 ^[1][2]. Organizations running versions older than 24.3.1 must upgrade to a supported version before they can apply the patch ^[1][5]. Patching does not undo exposure; organizations are advised to rebuild compromised appliances from clean images and rotate all dependency secrets, including API account secrets, SAML and directory bind accounts, and vaulted credentials ^[1].

The vendor provided conflicting dates for the protection of SaaS customers; sources ^[1] and ^[5] state SaaS tenants were patched on October 9, while source ^[8] states they were patched on October 8.

Extended risks to Privileged Remote Access

BeyondTrust also recommends that customers immediately patch self-hosted Privileged Remote Access (PRA) appliances ^[5][8]. The company stated that PRA shares the affected code with Remote Support ^[8].

While BeyondTrust has not identified any evidence that attackers are currently exploiting the vulnerability in PRA, the vendor released the patch as a precaution ^[8].

Joe Toomey, Vice President of Underwriting Security for Coalition, noted that threat actors may use large language models (LLMs) to reverse engineer patched firmware and launch broader copycat attacks ^[8].

What we don't know

• Which specific targets ARMORY CASTLE selected for the initial zero-day attacks in August?
• The total number of self-hosted appliances successfully compromised globally?
• Which specific downstream systems were accessed using the stolen credentials from the vault?