BeyondTrust Zero-Day Exploited by Chinese Spies for Seven Weeks

A trusted remote-access appliance became the attackers' way in

A suspected Chinese state-backed espionage group exploited a critical, previously unknown flaw in BeyondTrust Remote Support for about seven weeks before anyone outside the operation knew it existed. BeyondTrust disclosed the bug, CVE-2026-102764, on October 15, 2026. Google's Mandiant and Google Threat Intelligence Group (GTIG) say the group they now call ARMORY CASTLE, which they previously tracked as UNC5221, used it as a zero-day starting in late August.13 BeyondTrust's own timeline puts the first exploitation at August 29. That day the attackers compromised one Remote Support instance hosted by BeyondTrust and one appliance run by a customer.24

The company rates the flaw 9.3 on the CVSS v4.0 scale. It is classed as improper origin validation (CWE-290) in an internal messaging component: the component did not properly check where incoming messages came from, so a remote attacker with no login could perform file operations on the appliance.23 All supported self-hosted versions up to and including 26.2.3 are affected.410

This is not ransomware. It is a quiet intelligence operation against the product many companies use to control privileged access to the rest of their systems. That difference shapes both the damage done and the cleanup required.

How the intrusion unfolded

Mandiant's technical write-up describes attackers who knew the inside of BeyondTrust appliances well. They abused its proprietary command-line tools, its startup configuration templates and its local reverse-proxy routing.1 After using the flaw to upload files, they installed a lightweight PHP webshell called SAWFLY. It gave them interactive remote access and encrypted two-way command-and-control traffic.35 One account says the webshell, saved as mangoapi.php, was in place about 11 minutes after the exploit was first used.11

The webshell ran as an unprivileged service account, so the attackers next needed root. They copied the system shell to a file named to look like a legitimate D-Bus daemon and set the permission bit that makes it run as root. No second vulnerability was needed.1118 With root access, they turned to BeyondTrust's own secrets utility, /ns/sbin/bt-secrets. They tried several command forms to pull passwords, API keys and endpoint credentials from both site-level vaults and the appliance-wide password safe, then deleted the related logs.18

That theft explains how far the attack could reach. Using stolen administrator credentials, the attackers logged into the Remote Support portal and raised an account's Jump Item and team permissions from "No Access" to "Administrator." That let them open remote sessions to the systems the appliance manages.818 The Hacker News reports they then used those sessions to get full file-system access on internal machines and take sensitive documents.3

To keep their access, they placed a startup script in the appliance's boot directory. On every boot it puts passwordless root access back into the sudoers template, so a reboot or configuration reset does not remove it.1118 They also installed BARECLAW, a custom SOCKS5 tunneling tool written in C. A change to the appliance's HAProxy configuration made the tunnel reachable directly from the internet.3 To hide their traffic, they routed it through commercial VPN exit nodes and hacked home and small-office routers.3

Where the timelines disagree

Outlets agree on the outline but differ on details. Most date public disclosure to October 15.45 At least one analysis dates it to October 16 and counts the window as 48 days rather than 47.177 Most say SaaS customers were fully patched by October 9.34 Others say October 8, the day the patch was released.1417

The bigger disagreement is over who was hit first. BeyondTrust's advisory, as SecurityWeek and SOCRadar report it, names one BeyondTrust-hosted instance and one self-hosted appliance on August 29.24 The Hacker News describes the first case as a single self-hosted appliance.3 Another outlet's FAQ suggests confirmed exploitation was limited to self-hosted gear.9 The vendor's own wording carries the most weight here, so the better reading is that the attackers reached at least one BeyondTrust-hosted instance too. Cloud customers should not assume they were untouched just because they were patched automatically.

Coverage also differs on how close BeyondTrust came to catching the attack sooner. BeyondTrust found and contained the hosted intrusion on September 28, and Mandiant confirmed the same technique on the self-hosted victim two days later. BeyondTrust started that hunt after another security vendor's zero-day exploitation was confirmed on September 27. CyberScoop and others note this lines up with a round of Citrix NetScaler zero-days.1317 GTIG says the evidence so far does not show a coordinated targeting trend.17 TechTimes, citing CSO Online, adds a more awkward detail: BeyondTrust's sensors flagged the privilege escalation as it happened, but a third-party triage platform marked the alerts as false positives, which cost almost three more weeks.11

The questions BeyondTrust hasn't answered

Once the flaw was found, the fix arrived quickly: the bug was reproduced on September 28 and the patch shipped October 8.2 But eight days then passed before public disclosure. During that time self-hosted customers without automatic updates had no public warning that an exploited flaw needed urgent attention.17 When CyberScoop asked how many customers were compromised and why disclosure did not come sooner, a BeyondTrust spokesperson declined to answer and pointed to the advisory.13

Some of the delay may have been deliberate. Coordinating with government agencies and keeping exploit details private can slow copycats, and BeyondTrust has explicitly held back technical specifics for that reason.510 Still, the vendor will not give victim numbers. GTIG's Kelli Vanderlee called the known victim count small but said additional organizations may have been compromised before disclosure, given how stealthy the activity was.17 Customers are therefore left to judge their own risk largely on their own.

Disclosure may open a second, wider wave

The more serious risk may still be ahead. GTIG says ARMORY CASTLE and similar groups use a zero-day selectively against chosen targets, then switch to broad opportunistic exploitation once a flaw is public.1215 TechTimes notes the same pattern in the group's earlier Ivanti campaigns.11 Google has told organizations to prepare for "potential widespread exploitation."12

Governments acted quickly. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16 and gave federal civilian agencies until October 19 to patch.3 Canada's Cyber Centre and Germany's BSI issued their own alerts.11 Self-hosted customers on versions 24.3.1 through 26.2.3 need patch BT26-05-RS. Anyone on an older version must upgrade first.3 Privileged Remote Access shares some of the affected code. BeyondTrust has not found a working exploit against it but has released a precautionary patch.5

Patching does not undo a compromise that already happened, though. The persistence script survives reboots, and the attackers wiped local logs. That is why Mandiant advises rebuilding suspected appliances from a clean image rather than trying to clean them, and why BeyondTrust urges keeping telemetry off the appliance.112 Signs to look for include unexpected PHP files in web directories, unexplained root-run binaries, changes to HAProxy or sudoers templates, suspicious administrator role changes and gaps in log forwarding.5 Every credential stored in the vault should be treated as exposed and rotated.

A familiar actor, a familiar target

The group has a long record. Under its earlier names, including UNC5221, Warp Panda and UTA0178, it has been linked to exploitation of Citrix NetScaler and several Ivanti Connect Secure flaws.11 SecurityWeek describes it as focused on long-term intelligence gathering against SaaS providers, technology firms, government bodies, legal services and business-process outsourcers.4 Mandiant says the group changes its infrastructure and tools for each victim, so attribution depends on behavior rather than reusable indicators.13

BeyondTrust has also been here before. In December 2024, a different China-linked group, Silk Typhoon, used an earlier BeyondTrust compromise to break into the US Treasury, reaching workstations and unclassified documents.712 In February 2026, another Remote Support bug, CVE-2026-1731, was widely exploited after a public proof-of-concept appeared.7 Dark Reading puts the latest incident in a week when Ivanti, Cisco and Palo Alto Networks also disclosed actively exploited edge flaws.6

The problem is structural rather than one vendor's failing. Tools for privileged access and remote support are built to hold the keys to everything else. That makes them the most valuable foothold an espionage group can get, and an attacker who controls one inherits its trust across the network.9 BeyondTrust competes with CyberArk and Delinea in a market where the vendor's own security is the main thing it sells, and this incident will likely come up in renewal talks.15 For defenders, the practical response is to treat any internet-facing management appliance as a high-risk asset. That means sharply limiting its exposure, sending its logs somewhere attackers cannot delete them, and assuming its credentials may already be compromised.6