In a recent cyber espionage event, the China-associated group known as Armory Castle exploited a serious vulnerability in BeyondTrust Remote Support. This zero-day flaw, identified as CVE-2026-102764 with a high severity score of 9.3, was utilized in August 2026 to target a key component of the software.
Details of the Vulnerability
The core issue stemmed from improper origin validation within an internal messaging component. Remote attackers could exploit this to carry out unauthorized file operations on affected systems. BeyondTrust released an alert stating that under specific conditions, this flaw could be manipulated to control file processes on the appliance.
Patches were swiftly deployed to all SaaS users by October 9, 2026, and self-hosted users running versions 24.3.1 to 26.2.3 were urged to update manually. Older versions required an upgrade to apply the necessary security fixes.
Exploitation and Historical Context
Armory Castle took advantage of this vulnerability on a specific self-hosted appliance on August 29, 2026. This was followed by the public disclosure of an attack on another device provider in late September, prompting an investigation.
Historically, Armory Castle has targeted zero-day vulnerabilities in technologies like Citrix NetScaler and Ivanti Connect Secure, affecting various sectors including legal, SaaS, and government. Their strategy involves selective targeting of high-value software, followed by widespread exploitation upon public disclosure.
Technical Insights and Response
Following a breach, the hackers deployed a lightweight PHP web shell, codenamed SAWFLY, for remote access and encrypted communication. They used commercial VPNs and compromised routers to disguise their activities, gaining administrative control and persistence.
Their operations involved credential theft, leveraging administrative access to expand their reach, and exfiltrating sensitive documents. They used tools like BARECLAW, a custom proxy tunneler, to relay traffic and sustain their intrusion.
Experts from Mandiant noted the group’s deep understanding of BeyondTrust’s internal workings, utilizing proprietary utilities and configuration templates to bypass security measures. Systems exposed to the internet during the attack period are advised to be treated as potentially compromised.
This incident underscores the critical need for robust security measures and timely patching to protect against advanced persistent threats.
