BeyondTrust Zero-Day Turned Remote Support Into a Credential Bridge

On August 29, an unauthenticated path into BeyondTrust Remote Support became the point of entry. [BeyondTrust says](https://www.beyondtrust.com/blog/entry/bt26-05) a suspected China-nexus actor exploited the then-undisclosed CVE-2026-102764 against one BeyondTrust-hosted instance and one self-hosted appliance. [Mandiant’s incident-response account](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust) says the flaw allowed arbitrary file upload before the operator established persistence and moved toward credentials and downstream systems. ## Affected systems The confirmed vulnerable product is BeyondTrust Remote Support. The [vendor advisory](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05) lists all supported versions through 26.2.3 as affected. Remote Support SaaS instances were patched by BeyondTrust on October 9. Self-hosted customers on versions 24.3.1 through 26.2.3 can apply BT26-05-RS; older deployments must first upgrade. BeyondTrust also patched Privileged Remote Access because it shares affected code, but says its internal testing has not found a way to exploit that product. That distinction matters: shared code warrants mitigation, not a claim of observed compromise. ## Access path The vendor describes inadequate origin validation inside an internal messaging component. Under the right conditions, a remote unauthenticated attacker could perform file operations on the appliance. Mandiant reports that in the investigated intrusion this became a file-upload path, then a web foothold and root-level control. This report withholds exploit syntax and payload details. Defenders need the door, the evidence and the repair boundary—not a duplicate key. ## Evidence Mandiant attributes the activity to ARMORY CASTLE, formerly UNC5221, a suspected PRC-nexus espionage cluster. BeyondTrust says its own assessment is moderate to high confidence and rests on behavior and tradecraft; the indicators rotate between victims. That is attribution, not a court finding. The observed operator planted a web shell, escalated privileges, established reboot-persistent access, attempted to extract secrets brokered by the appliance, changed remote-access permissions and used legitimate support features to reach downstream endpoints. The actor also deleted local logs and artifacts. BeyondTrust says a third-party detection system initially closed high-severity alerts as false positives; a later threat-intelligence-driven hunt found the hosted compromise. ## Preserve the scene Both investigators emphasize off-appliance evidence. Forwarded syslog, session records, identity-provider events and other external control-plane logs may survive when local evidence has been deleted or altered. Preserve those records and image a suspected appliance before rebuilding it. Integrity is not a feeling an appliance can recover after its own memory has been edited. ## Neighboring systems and blast radius A Remote Support appliance can broker privileged credentials and authorized sessions across many endpoints. Mandiant observed an operator expanding permissions over Jump Items and Teams, then using the product’s own remote-support channel to inspect a downstream system and remove internal documents. A compromised gateway should therefore be investigated as both a host and a map of reachable machines. The public reports document two exploited Remote Support appliances. They do not establish compromise of every internet-exposed instance, every downstream endpoint or Privileged Remote Access. ## Impact Successful exploitation can yield host-level control, access to credentials stored or injected by the appliance, persistent access and authorized-looking remote sessions into neighboring systems. That converts a trust gateway into a credential bridge. The confirmed cases involved espionage tradecraft; the disclosures do not report ransomware deployment. ## Mitigation Apply the BT26-05 patch immediately or confirm automatic application. Restrict administrative interfaces to trusted networks, reduce exposed services, constrain outbound traffic, and forward appliance and session logs off the box. Review unexplained privileged sessions, permission changes, web-service processes launching shells and gaps in log forwarding. If evidence of exploitation exists, rotate every credential the appliance stored or brokered, review privileged-account activity and new multifactor registrations, and investigate downstream systems reached through the appliance. ## Repair versus recovery Patching repairs CVE-2026-102764; it does not remove established persistence, restore deleted evidence or revoke stolen credentials. An exposed but apparently quiet appliance needs review. A confirmed compromise requires evidence preservation, credential rotation, downstream scoping and a rebuild or other recovery action guided by the vendor and incident responders. ## Uncertainty BeyondTrust confirms two compromises on August 29 and says one hosted instance was contained after detection on September 28. Mandiant warns that broader exploitation may follow disclosure, but that is a forecast, not proof that it has occurred. Victim identities, the full downstream scope and any data taken from the self-hosted environment are not public. ## Case status Tracking. The patch shipped October 8 and public disclosure followed October 15. The case remains open because remediation status across self-hosted deployments and the scope of any additional exploitation are unknown.