BeyondTrust Remote Support Zero-Day CVE-2026-102764: China APT Had Root Access for 7 Weeks

CVE-2026-102764 is an improper authentication flaw (CWE-290) in BeyondTrust Remote Support's internal messaging component. The authentication enforcement gap allows an unauthenticated remote attacker to trigger arbitrary file operations on the appliance without presenting valid credentials.

BeyondTrust Remote Support is a web-based platform that runs as an appliance (hardware or virtual) and exposes a management interface for help desk technicians to initiate remote sessions. The appliance stores session routing logic, stored credentials, and customer configuration in internal services. The vulnerable component processes messages from session participants and management requests during the support workflow.

The flaw's critical severity stems from what file operations enable on an appliance with this footprint. BeyondTrust Remote Support runs with elevated system privileges to manage remote desktop sessions, transfer files, and execute commands on connected endpoints. Arbitrary file write access to the appliance allows an attacker to deploy webshells to the web-accessible application directory, overwrite configuration files, or write executable payloads to startup directories, any of which enables persistent code execution under the appliance's privileged service context.

ARMORY CASTLE's documented exploitation path shows exactly this progression: file operations via the authentication bypass provided the foothold, followed by privilege escalation to root using the appliance's own elevated service context. From root, the attacker deployed two custom tools:

• Sawfly: a custom webshell providing browser-accessible persistent access to the appliance
• Bareclaw: a custom tunneling tool establishing a covert command-and-control channel independent of BeyondTrust's normal traffic patterns

Both tools survived patch deployment on instances where the attacker had already established persistence before the October 8-15 patch window. Patching the CVE on a already-compromised instance does not remove a deployed Sawfly webshell or Bareclaw tunneler.

Privileged Remote Access shares the same codebase and is equally vulnerable. Privileged Remote Access is the higher-security variant designed for vendor and contractor access to critical infrastructure. Both product lines affect versions 24.3.1 through 26.2.3.

ARMORY CASTLE's exploitation of CVE-2026-102764 began August 29, 2026, forty-seven days before BeyondTrust published advisory BT26-05-RS for self-hosted instances. Mandiant and Google Threat Intelligence Group reconstructed the full attack chain from available forensic artifacts.

Initial exploitation (August 29): ARMORY CASTLE used the unauthenticated file operation to write the Sawfly webshell to BeyondTrust's web-accessible directory. At this point the attackers have persistent access even if the original authentication bypass is later patched, because the webshell provides a separate access channel.

Privilege escalation: The attacker used the foothold to escalate to root on the appliance operating system. BeyondTrust Remote Support runs with the level of privilege required to initiate remote sessions, transfer files, and execute commands on connected systems. Root access on the appliance gives the attacker those same capabilities plus control over the appliance's own configuration, networking, and stored secrets.

Persistence and covert channel: ARMORY CASTLE deployed the Bareclaw tunneler alongside Sawfly. Bareclaw establishes an outbound covert communications channel, allowing the attacker to issue commands and retrieve data without triggering alerts on inbound connection monitoring. This is a standard technique for maintaining access when inbound connections to the compromised host would be blocked or logged.

Credential harvesting and access control manipulation: The attacker harvested credentials stored on or accessible from the appliance: stored service account passwords, API keys, session tokens, and administrator accounts that BeyondTrust technicians use to authenticate to managed systems. Access control entries were modified, likely to create additional persistence paths or prevent legitimate administrators from revoking attacker access.

Log deletion: System logs, web-server logs, and application logs were deleted to prevent forensic reconstruction of the attack timeline. This makes it impossible to determine definitively which systems were accessed, what credentials were taken, or what commands were issued during the 7-week window. BeyondTrust's own advisory acknowledges that absence of log evidence does not indicate an absence of compromise.

Document exfiltration: Internal documents were exfiltrated through BeyondTrust's own built-in file transfer service, a legitimate feature of the platform designed for moving files between technician and endpoint. Using the platform's own exfiltration channel means the traffic patterns are indistinguishable from authorized file transfers.

Lateral movement: ARMORY CASTLE pivoted from the BeyondTrust appliance into downstream enterprise systems. The specifics of what systems were reached are not public, but the attack surface reflects the appliance's normal operating permissions: everything a BeyondTrust technician could access through legitimate sessions was reachable through the compromised appliance.

The full scope of the breach depends on what credentials were harvested and what systems BeyondTrust Remote Support was authorized to connect to in each affected environment. Organizations should map every system their BeyondTrust deployment could reach during August 29 through October 9 as the starting point for determining breach impact.

ARMORY CASTLE is attributed by Mandiant and Google Threat Intelligence Group to Chinese state-sponsored cyber operations. The group is tracked under multiple naming conventions across the security industry:

• Mandiant/GTIG: ARMORY CASTLE
• Alternative tracking: UNC5221, WARP PANDA
• Classification: Nation-state cyber espionage, China-nexus

ARMORY CASTLE's operational pattern demonstrates a sustained focus on high-privilege remote access infrastructure. The group's toolkit includes custom-developed tools (Sawfly webshell, Bareclaw tunneler) built specifically for persistent post-exploitation on enterprise support platforms. Custom tooling development indicates an advanced threat actor with dedicated engineering resources and long-term operational planning rather than opportunistic exploitation.

MITRE ATT&CK technique mapping for this campaign:

• T1190 - Exploit Public-Facing Application (CVE-2026-102764 unauthenticated file operations)
• T1068 - Exploitation for Privilege Escalation (root escalation from appliance service context)
• T1505.003 - Server Software Component: Web Shell (Sawfly webshell deployment)
• T1572 - Protocol Tunneling (Bareclaw covert communications tunnel)
• T1003 - OS Credential Dumping (credential harvesting from appliance)
• T1098 - Account Manipulation (access control modification)
• T1070.001 - Indicator Removal: Clear Windows Event Logs (full log deletion to obstruct forensics)
• T1048 - Exfiltration Over Alternative Protocol (exfiltration via BeyondTrust's own file transfer)
• T1570 - Lateral Tool Transfer (pivoting into downstream connected systems)

The selection of BeyondTrust Remote Support as a target follows a documented pattern of Chinese APT operations targeting enterprise management and support tooling. Prior campaigns targeting Ivanti Connect Secure and FortiGate network implants by Chinese state-affiliated groups reflect the same strategic priority: compromise the tool that has legitimate access to everything else, rather than pivoting through the environment one hop at a time.

BeyondTrust confirmed it is aware of only two specific affected customer instances at the time of advisory publication. However, CISA's decision to add CVE-2026-102764 to the KEV catalog and the 3-day federal remediation window reflect the assessment that exploitation could scale beyond the known-affected instances, particularly given that the zero-day window extended 47 days before the patch shipped.

No specific command-and-control IP addresses, domains, or file hashes for the Sawfly webshell or Bareclaw tunneler have been publicly released as of October 20, 2026. BeyondTrust and Mandiant have not published IOC lists in their public advisories. The behavioral indicators below reflect the documented attack pattern and known post-exploitation artifacts.

These indicators are generated from the CVE and campaign context. Validate against your environment's baseline before enabling automated blocking. Organizations that suspect active compromise should engage incident response rather than relying solely on these automated indicators.

Both rules carry experimental status. Validate against your environment's BeyondTrust deployment before enabling automated blocking, as legitimate scripted remediation sessions initiated by authorized technicians may trigger the first rule. The second rule targets IIS-spawned shells and is higher confidence for BeyondTrust-specific deployments.

The CISA KEV remediation deadline expired October 19. Self-hosted BeyondTrust appliances that have not applied BT26-05-RS must be patched immediately. SaaS instances were updated automatically on October 8. Remediation does not end with patching: any appliance that ran vulnerable since August 29 must be treated as a potential breach, regardless of log evidence.

BeyondTrust Remote Support and Privileged Remote Access are tools specifically engineered to reach every system in an enterprise. They authenticate through trusted certificates, bypass normal network segmentation, and are exempt from the same access controls that prevent most lateral movement. An attacker with control of the BeyondTrust appliance effectively has control of whatever the appliance can reach, operating through traffic that looks identical to a legitimate help desk session.

CVE-2026-102764 demonstrates why remote access and privileged access management tooling is consistently the highest-value target for sophisticated threat actors. ARMORY CASTLE did not need to pivot through the network one hop at a time. They compromised the tool that already had access everywhere. CISA's 3-day federal remediation deadline (issued October 16 for an October 19 deadline) reflects the same assessment: this class of vulnerability in this class of tooling requires emergency response, not standard patch cycle timing.

The 7-week exploitation window is also instructive. BeyondTrust's SaaS customers were protected on October 8 without any action required. Self-hosted customers who did not maintain active monitoring of BeyondTrust advisories had 7 weeks of exposure that they may not know about. Organizations running critical infrastructure RMM tooling on self-hosted appliances should establish a direct advisory subscription for every vendor in their privileged access stack and treat new advisories from those vendors as equivalent to CISA emergency directives in terms of patch priority.

A clean audit log does not mean a clean system. BeyondTrust's own advisory acknowledges this explicitly. Any organization that ran an unpatched self-hosted appliance from late August through October 15 should engage incident response, rotate credentials, and verify integrity of systems connected through BeyondTrust, regardless of what the logs show.