China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign

The Hacker News reports that the flaw, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component[2]. According to The Hacker News, the group responsible is Armory Castle (previously UNC5221 or Warp Panda)[2].According to BeyondTrust's timeline, as reported by The Hacker News, the group exploited the flaw as a zero-day on a single self-hosted Remote Support appliance on August 29, 2026[2].CSO Online reports that Mandiant said that about 11 minutes after the first malicious request, a PHP web shell Mandiant calls SAWFLY appeared[3]. CSO also reports that the attacker deployed BARECLAW, a custom SOCKS5 tunneler[3], and that it later deleted more than a dozen system, web server, and application logs.[3]GTIG's Kelli Vanderlee told Cybersecurity Dive that her team is "aware of only a small number of impacted organizations at this time"[1], but that others may also have been compromised. BleepingComputer reports that BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8[4], while The Hacker News puts the date at October 9. According to The Hacker News, self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update to BT26-05-RS patch.[2]GTIG and Mandiant warned in a blog post, according to CSO Online, that "Organizations should prepare for potential widespread exploitation following this disclosure."[3]