China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

What happened

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

According to a timeline of events shared by BeyondTrust, Armory Castle is said to have exploited the flaw as a zero-day on a single self-hosted Remote Support appliance on August 29, 2026.

What changed

BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.

While the company shared limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221 ) and by cybersecurity firm CrowdStrike as "Warp Panda." According to Mandiant researchers, who spotted the initial attacks, Armory Castle hackers exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions.

Who is affected

The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.

Under the right conditions, this could be used to perform file operations on the appliance." Patches for the flaw have been pushed to all Remote Support SaaS customers as of October 9, 2026.

Why it matters

The Chinese state-backed Silk Typhoon hacking group is also believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems and use a stolen API key to compromise 17 Remote Support SaaS instances, including the U.S.

Most recently, attackers exploited another critical remote code execution vulnerability (CVE-2026-1731) affecting Remote Support and Privileged Remote Access appliances to establish WebSocket channels and deploy ransomware .

Technical details

Self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update to BT26-05-RS patch.

Remote Support is the company's enterprise-grade support solution that helps IT service desks, help desks, and customer support teams troubleshoot issues remotely.

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

Response

Tracked as CVE-2026-102764 , this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier.

Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems.

What security teams should do

BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled.

Customers running a version older than 24.3.1 will be required to upgrade to a newer version to apply the fix.

Attribution

The Hacker News: The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

BleepingComputer: BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.

What to watch next

Watch for new exploitation reports and updated indicators of compromise.

Watch for updated vendor guidance and fixed-version details.