Chinese APT Exploited BeyondTrust Zero-Day Vulnerability
Security researchers reveal that a China-linked threat actor leveraged a BeyondTrust zero-day flaw for state-sponsored espionage, deploying custom webshells and tunneling tools.
Radwan AbdulhadiEditor and technology writer
Zero-Day Exploitation and Vulnerability Details
A state-sponsored Chinese advanced persistent threat (APT) group has been actively exploiting a security flaw in BeyondTrust Remote Support appliances as a zero-day since late August. The vulnerability, tracked as CVE-2026-102764, carries a CVSS severity score of 9.3 and stems from improper validation of message origins. This defect allows malicious actors to execute file operations on vulnerable Remote Support appliances.
According to disclosures provided by BeyondTrust, all Remote Support versions up to and including 26.2.3 are affected by the issue. Initial exploitation activity was detected on August 29 against both a BeyondTrust-hosted and a self-hosted appliance. Detailed insight regarding the investigation and remediation timeline can be found in the advisory shared by BeyondTrust says.
Attribution and Threat Actor Profile
Investigators tracking the campaign have attributed the zero-day activity to a China-linked threat actor known as Armory Castle, which is also tracked by security researchers under the aliases UNC5221 and Warp Panda. Comprehensive technical analysis of the group's methodology and campaign scope has been published by Mandiant and GTIG.
Armory Castle operates as a state-sponsored espionage group that specializes in long-term intelligence gathering. The cyberespionage collective frequently targets high-value sectors, including SaaS providers, technology companies, government entities, legal services, and business-process outsourcers across various geographic regions.
Attack Chain and Custom Tooling Deployment
During the targeted attacks observed by threat intelligence analysts, Armory Castle leveraged the BeyondTrust flaw to gain initial access to targeted environments. Following entry, the actors deployed the Sawfly webshell—a lightweight PHP utility featuring bidirectional encrypted command-and-control communication capabilities—as their primary foothold.
Once established, the threat actors achieved root-level control of the host appliance, harvested system credentials, and secured passwordless root privileges for the site service account. To cover their tracks, the operators systematically deleted system, web server, and application-level logs before pivoting to internal enterprise assets.
The operational toolset also incorporated Bareclaw, a custom SOCKS5 proxy tunneler equipped with data authentication, traffic chaining to upstream proxies, and traffic encryption features. The attackers utilized native built-in support tools and file transfer capabilities to download and exfiltrate sensitive internal documentation, such as software inventories, directly from user desktops for subsequent network reconnaissance.
Historical Context and Prior Campaigns
Security analysts note that Armory Castle has a documented history of exploiting high-severity zero-day vulnerabilities in enterprise edge appliances. Prior campaigns conducted by the group have targeted prominent products with exploits such as CVE-2023-4966 affecting Citrix networking equipment.
Additionally, the state-sponsored cyberespionage group has previously targeted virtual private networks and enterprise infrastructure through vulnerabilities including CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282, as well as exploiting zero-days in virtualization and storage tools like CVE-2026-22769.
Response and Remediation Measures
Upon discovering the security defect, BeyondTrust moved quickly to develop a patch, completing testing and handling additional potential exploitation paths before publicly issuing the fix. For cloud customers, the vendor confirmed that remediation updates were successfully applied across all Remote Support SaaS instances.
Self-hosted customers running affected versions 24.3.1 through 26.2.3 have been advised to manually install the BT26-05-RS patch. Organizations utilizing older software releases are required to upgrade to a supported version prior to applying the necessary security updates.
Sources
- SecurityWeekChinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Continue chronologically
Related stories
BeyondTrust Patches Zero-Day Exploit Active Since August
BeyondTrust issues a patch for a critical Remote Support zero-day authentication bypass vulnerability exploited in the wild since late August.
Hackers Exploit Citrix NetScaler Zero-Day Vulnerabilities
Cybersecurity firms report that attackers are actively exploiting Citrix NetScaler zero-day vulnerabilities to deploy web shells and tunneling malware.
NetScaler Zero-Day Attacks Hit Government and Finance Sectors
Government and financial organizations in North America and Europe face weeks-long zero-day attacks exploiting NetScaler vulnerabilities.
Bitget Reveals Hack Caused by Third-Party Zero-Day
Cryptocurrency exchange Bitget reveals that attackers who stole $387.5 million breached its systems via a zero-day flaw in third-party security products.
