BeyondTrust Zero-Day (CVE-2026-102764): Patch Now, Check for Intrusion

Alex leads a three-person IT team at a logistics company in Toronto. Their favorite tool is BeyondTrust Remote Support. When a driver’s laptop freezes at 2 a.m., Alex takes it over from a phone and fixes it before anyone wakes up.

That one box holds the keys to every computer the team supports. Alex rarely thinks about it. Nobody does. It just sits there, working.

Between late August and mid-October, a suspected Chinese spy group had a way into that kind of box. For about seven weeks, almost nobody outside a small circle knew.

BeyondTrust Zero-Day: Key Facts

• CVE: CVE-2026-102764
• Product: BeyondTrust Remote Support, formerly called Bomgar
• Severity: Critical, 9.3 out of 10
• Advisory: BT26-05, published October 15, 2026
• The flaw: The box doesn’t properly check who sent it an internal message, so an outsider with no login can make it perform file operations
• Affected: All versions up to and including 26.2.3
• First used in attacks: August 29, 2026
• Found by BeyondTrust: September 28, during its own hunt for trouble
• Patch released: October 8, with the cloud service fixed by October 9
• Attacker: A group called ARMORY CASTLE, suspected to be linked to China
• Widespread attacks: Not confirmed as of October 15, but Google warns they may follow
• Fix for self-hosted boxes: Install patch BT26-05-RS yourself

What This Box Does

Remote Support is how help desks take control of other people’s computers. An employee calls, the technician connects, and the problem gets fixed from far away.

To do that, the box needs a lot of power. It stores passwords, access keys and login details for the computers it manages. Google’s researchers put it bluntly. A successful attack can lead to control of the box and access to every login it stores.

So if someone takes over this one box, they don’t just get a foot in the door. They get the whole key cabinet.

What Went Wrong

Think of a company mailroom. Internal memos arrive stamped “From: Head Office,” and the mailroom staff do whatever the memo says.

Now imagine nobody checks whether the memo really came from inside. A stranger could copy the stamp, write “Please put this file in the server room,” and the mailroom would do it.

That’s the flaw. The box has an internal messaging part meant to talk only to its own other pieces. It doesn’t properly check who sent a message. An outsider can pretend to be inside and make the box handle files for them.

Being able to place a file on someone else’s server is a short step from running your own code on it. That’s what happened next.

The Seven Quiet Weeks

• August 29: ARMORY CASTLE uses the flaw for the first time. BeyondTrust says one BeyondTrust-hosted system and one customer-run box were hit.
• September 28: BeyondTrust spots the break-in while hunting for trouble. It started looking hours after another vendor’s attack went public and Mandiant sent a vague warning.
• October 8 to 9: Fixes arrive. The cloud service is patched.
• October 15: BeyondTrust tells the public.

That’s about seven weeks between the first break-in and customers hearing about it. Credit to BeyondTrust for catching this by actively looking, not by waiting for a complaint. But the gap is the story. By the time most customers heard, someone skilled had already used the flaw.

A flaw like this is called a zero-day. It means attackers knew about it before the vendor had a fix ready.

What the Attackers Did Inside

Google and Mandiant laid out the steps, and they read like a professional break-in.

They planted a hidden control panel. It’s a small file called SAWFLY that lets them send commands to the box in secret and get encrypted replies.

They made themselves the boss. They set up a copy of a standard tool at /usr/bin/dbus-authd so it always runs with full admin power. Then they added startup settings so their access survives a restart.

They raided the password safe. They used BeyondTrust’s own built-in tool to pull out stored passwords, access keys and logins.

They opened a hidden tunnel. A tool called BARECLAW works like a secret pipe that moves traffic through your box and into your network. The attackers changed the box’s settings so the pipe could be reached from the internet.

They used the box’s own features against the company. With stolen or changed admin powers, they started real support sessions into internal computers, looked around, and downloaded documents that helped them plan their next move.

They erased their tracks. Logs were deleted.

Google noted that the attackers clearly knew the box’s insides, since they used its own tools and settings.

Who Is Behind It

Google and Mandiant blame ARMORY CASTLE, a suspected China-linked spy group also known as UNC5221 and Warp Panda. The call is based on how the group works, since it swaps tools and servers for every victim. It’s a professional judgment, not a signed confession.

The same group has been linked to earlier attacks on other network gear, including Citrix NetScaler. Google warns that groups like this often go from careful, targeted attacks to broad ones once a flaw becomes public.

Patching Is Not Enough

Read this part twice.

Mandiant’s advice is that any box reachable from the internet on a vulnerable version since late August should be treated as possibly hacked until someone reviews it. The attackers set up access that survives a restart and wiped logs. So a patched box can still be running their tools.

And missing logs don’t prove you’re safe. They may prove the opposite.

Signs of a Break-In

These come from published Google and Mandiant findings. Mandiant also released detection rules for SAWFLY and BARECLAW, so use those too.

# BeyondTrust Remote Support CVE-2026-102764 (ARMORY CASTLE)

Hidden control panel (SAWFLY):
  File name: mangoapi.php
  Fingerprint (SHA-256): dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
  Seen in: /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/
  Command word used: _c94mfe

Hidden tunnel (BARECLAW):
  File name: ingredi_ws
  Fingerprint (SHA-256): 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462
  Local port: TCP 19800
  Web path: /uidchanarge

Things to look for on the box:
  A file at /usr/bin/dbus-authd that runs with full admin power
  A startup script named zz-root-persist
  Changes to /ns/config/sudoers.template
  Changes to /ns/config/haproxy.conf
  The built-in password tool (bt-secrets) used when nobody was doing admin work
  Gaps or deleted entries in the logs

Things to look for in the app:
  Admin permission changes you didn't make
  Support sessions into internal computers that nobody started
  File downloads from desktops during those sessions

What to Do, Step by Step

Step 1: Find every self-hosted Remote Support box you run.
  Versions up to 26.2.3 are affected.
  The cloud service was patched by BeyondTrust.

Step 2: Install the patch.
  Apply BT26-05-RS from the box's admin page.
  Upgrade any unsupported version first.

Step 3: Treat exposed boxes as possibly hacked.
  Reachable from the internet since late August? Assume yes.

Step 4: Look for the signs above.
  Use Mandiant's published detection rules.
  Ask BeyondTrust support for help if you can't check yourself.

Step 5: Review sessions and admin changes.
  Look back to August 29.

Step 6: Change everything the box stored.
  Passwords, access keys, logins, admin accounts.
  Do this after the box is confirmed clean, not before.

Step 7: Check the computers it managed.
  Especially any that had a session you can't explain.

Five Priorities for Your Security Team

Priority 1: Patch today. Attacks may spread fast now that the details are public.

Priority 2: Look back to August 29. The risk didn’t begin on October 15.

Priority 3: Assume the stored secrets are exposed. If the box was reachable and vulnerable, change everything it held. It’s tedious, but it’s the safe call.

Priority 4: Check for support sessions nobody started. The attackers used the tool’s own features, so their activity can look like normal help-desk work.

Priority 5: Ask why the box faces the internet. Some have to. If yours doesn’t, limit who can reach it.

The ZyberWalls Perspective

The flaw isn’t the unusual part. The target is.

Attackers keep going after tools that sit at the edge of a network and hold power over everything behind them. Remote access boxes, VPNs, support tools. They’re trusted, always on, and rarely watched as closely as laptops. Break one, and you inherit its trust.

There’s also a lesson in how this came to light. BeyondTrust found the attack by actively hunting after a tip, not by waiting for an alarm. That’s the standard to aim for. Sitting back and trusting that nothing’s wrong is how seven weeks go by.

Alex patched on Friday. Then came a job Alex had never had to do. They wrote down every password the box could see and started changing them, one by one. It took the whole weekend. And Alex wondered, quietly, whether the last seven weeks of logs would show anything useful, or whether someone had already cleaned them.

There’s no tidy ending. Only the patch, a careful look back, and the habit of asking what your most trusted tool could do if someone else were holding it.

→ Read the latest on SonicWall: SonicWall SMA1000 CVE-2026-102255: Exploit Attempts Begin

Stay Alert. Stay Human. Stay Safe.
— ZyberWalls Research Team