China-linked hackers have been exploiting a BeyondTrust flaw since August

BeyondTrust warned customers on Thursday to patch a critical vulnerability in its Remote Support software, saying it had been exploited in zero-day attacks since late August. The flaw, tracked as CVE-2026-102764, affects Remote Support 26.2.3 or earlier.

The vulnerability bypasses authentication, allowing unprivileged remote attackers to carry out file operations on appliances that have not been patched. Google warned that suspected China-linked hackers could exploit the BeyondTrust flaw, placing users of the remote access software at risk of system compromise.

BeyondTrust disclosed the issue on October 15 after Google Cloud Researchers identified the exploitation.

Mandiant and Google Threat Intelligence Group attribute the activity to a suspected China-nexus espionage actor known as Armory Castle, previously tracked as UNC5221. CrowdStrike tracks the same group as Warp Panda.

Mandiant researchers said the attackers used the flaw for their initial access, then obtained root privileges on compromised devices by enabling Set User ID, or SUID, permissions. That combination gives an intruder a route from an exposed support appliance towards control of the device itself.

Armory Castle has previously targeted remote-access infrastructure at considerable scale. Volexity said in January 2024 that UNC5221 had implanted the GiftedVisitor webshell on more than 2,100 Ivanti appliances. Those attacks combined the CVE-2023-46805 and CVE-2024-21887 zero-days.

BeyondTrust has also been hit before. Chinese state-backed Silk Typhoon exploited CVE-2024-12356 and CVE-2024-12686 to breach BeyondTrust’s systems. The group used a stolen API key to compromise 17 Remote Support SaaS instances, including an instance used by the US Treasury Department.

For users running the affected Remote Support versions, the immediate instruction from BeyondTrust is straightforward: apply the patch before an attacker can use the authentication bypass to establish access.