BeyondTrust Remote Support zero-day exploited since August

A suspected China-linked spy group exploited an unknown flaw in BeyondTrust Remote Support from August 29, 2026, BeyondTrust and Google's security teams disclosed on October 15 and 16. Remote Support is the tool IT help desks use to take control of employees' computers, so a hacked server can reach many machines. The flaw is tracked as CVE-2026-102764 and rated 9.3 out of 10. Cloud customers are already patched, but self-hosted servers need a manual update.

BeyondTrust, formerly known as Bomgar, says it has more than 20,000 customers, BleepingComputer reports. The internet scanning group Shadowserver counts more than 1,400 Remote Support servers exposed online.

What the flaw does

The bug sits in an internal messaging part of Remote Support. "The components did not adequately validate the origin of the messages it received," BeyondTrust said, as quoted by The Hacker News. In practice, an attacker who is not logged in can upload and change files on the appliance. BleepingComputer describes it as an authentication bypass, meaning the attacker skips the login step entirely.

BeyondTrust first saw the attack on August 29 against one self-hosted appliance. It began looking after another security vendor's devices were publicly reported as exploited on September 27, The Hacker News says. The company said the attacker "uses a zero-day selectively against chosen targets."

Who is behind it and what they did

Google Threat Intelligence Group and Mandiant tie the attacks to a group they call ARMORY CASTLE. Google calls it a suspected China-nexus espionage actor, active since October 2023 and formerly tracked as UNC5221. CrowdStrike calls the same group Warp Panda, according to BleepingComputer.

Google's report lists the steps the attackers took after getting in:

• A web shell. About 11 minutes after the first request, they planted SAWFLY, a small program that lets them run commands over the web.
• Root access. They made a special copy of the system shell that runs with full admin rights.
• Stolen secrets. They pulled credentials from the appliance's built-in password vault.
• A hidden tunnel. They installed BARECLAW, a proxy on port 19800, and changed the web server settings so it was reachable from the internet.
• Persistence and cleanup. A boot script gave them a passwordless admin login, and they deleted logs throughout.

Google warns that more attacks may follow. "Organizations should prepare for potential widespread exploitation following this disclosure," the report says.

Which versions need the patch

Deployment	Status	What to do
Remote Support cloud (SaaS)	Patched by BeyondTrust	Nothing to install
Self-hosted 24.3.1 to 26.2.3	Vulnerable	Apply patch BT26-05-RS
Self-hosted older than 24.3.1	Vulnerable	Upgrade first, then patch
Privileged Remote Access	No known way to exploit it, per BeyondTrust	Cloud instances were patched too

The sources differ on when cloud customers were fixed. BleepingComputer says October 8, while The Hacker News and Google say October 9.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known exploited bugs on October 16. Federal civilian agencies must fix it by October 19, The Hacker News reports.

What this means for developers

If your company runs its own Remote Support server, treat this as an emergency, not a routine update. Automatic updates may be off, and BleepingComputer notes those servers need the patch applied by hand.

Patching is not enough on its own. Mandiant says an exposed appliance "should be treated as potentially compromised until it has been reviewed." That means:

1. Install BT26-05-RS today, after upgrading to 24.3.1 or later if needed.
2. Hunt for the attacker's tools. Google's report publishes file hashes for the web shell and describes the BARECLAW tunnel on port 19800. Check the web server settings for routes you did not add.
3. Rotate every secret the appliance held. The attackers read its credential vault, so any password or key stored there should be changed.
4. Check where those credentials work. A support tool reaches many machines, so look for logins from the appliance to other systems since late August.

The attack follows Ivanti Connect Secure's chained zero-days earlier this week. Remote-access tools sit at the network's edge with broad powers, which makes them a favorite target. If yours can be put behind a VPN or an allowlist of addresses, do it now.