A suspected China-nexus hacker has exploited a zero-day vulnerability in BeyondTrust Remote Support since late August as part of an espionage campaign, according to a report released Thursday by Google Threat Intelligence Group.
The hacker, tracked under the name Armory Castle, has deployed custom backdoors and used the support tool’s administrative access to harvest credentials and steal sensitive information to help with reconnaissance.
The critical vulnerability, tracked as CVE-2026-102764, is related to internal components of Remote Support not being able to confirm the origin of a message. Under certain circumstances, an attacker can then perform file operations on an affected appliance.
BeyondTrust issued a patch on Oct. 9, which was automatically sent to software-as-a-service customers. Self-hosted customers should immediately do a manual upgrade if they have not previously signed up for automatic upgrades, BeyondTrust said.
The threat activity was discovered in late September, when Mandiant, the incident response arm of GTIG, was investigating a zero-day vulnerability targeting edge devices on another vendor’s products, according to a blog post by BeyondTrust.
Mandiant alerted BeyondTrust, and the company found an affected SaaS instance. The exploitation activity was traced to late August.
“We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure,” Kelli Vanderlee, senior analyst at GTIG, told Cybersecurity Dive.
The hacker, previously tracked as UNC5221, is a known espionage actor that has targeted legal services, government, technology companies, SaaS vendors and business process outsourcers, according to BeyondTrust’s post.
“Armory Castle is a prime example of why edge and remote access technology remains some of the most valuable targets for nation-state operators,” Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive. “They sit at the boundary of the enterprise while holding privileged access to what lies behind it.”
Stealthy behavior
In this instance, the attacker deployed custom malware that has not previously been identified. These included a PHP web shell called Sawfly, which enabled encrypted C2 communication, Mandiant said. The hacker gained root level access to the host and was able to access all credentials stored on the appliance. A custom SOCKS5 proxy tunneler called Bareclaw was also deployed.
The actor targeted the secrets management database on the appliance to harvest credentials. The hacker moved laterally to gain administrative privileges and then access files. The native BeyondTrust file transfer service was used to download sensitive information to conduct reconnaissance.
The actor, which CrowdStrike tracks as Warp Panda, has been active since 2023. Mandiant previously tracked the same actor in a campaign targeting CVE-2025-22457, a critical vulnerability in Ivanti Connect Secure.
BeyondTrust said customers should reduce their exposure by limiting administrative interfaces to trusted networks. Security teams should also forward appliance system logs and session events to the security information and event management platform, as the hacker has deleted forensic evidence in prior attacks.
