BeyondTrust Remote Support is the tool many help desks use to take over an employee’s screen. Mandiant says a China-linked espionage group has been breaking into those appliances since late August, with no patch available until October 8.
CISA added the bug to its exploited list on Friday and gave federal agencies until today, Monday, October 19, to deal with it. If your company hosts its own Remote Support appliance, patching is only half the job. Someone also has to check whether it was already used.
The tool your help desk uses to take over employee laptops was a spy group’s way in for six weeks before a fix existed. Patch it, then check it.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
A China-linked group used the BeyondTrust bug for six weeks before a fix
BeyondTrust published advisory BT26-05 on October 15 for CVE-2026-102764, a flaw in an internal messaging component of Remote Support (formerly Bomgar) that did not check where messages came from. A remote attacker with no login can use it to perform file operations on the appliance. BeyondTrust rates it 9.3 under CVSS 4.0, and every Remote Support version up to 26.2.3 is affected.
According to SecurityWeek’s account of BeyondTrust’s timeline, the first attacks hit one BeyondTrust-hosted and one self-hosted appliance on August 29. BeyondTrust found the flaw on September 28, shipped the fix on October 8 and finished patching its SaaS customers on October 9. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16 with a due date of October 19.
Mandiant and Google Threat Intelligence attribute the attacks to ARMORY CASTLE, the group they previously tracked as UNC5221. After getting in, the group dropped a PHP webshell Mandiant calls SAWFLY and a SOCKS5 tunneler called BARECLAW, took root on the appliance, harvested credentials and deleted system, web server and application logs.
Self-hosted Remote Support appliances are the target
A Remote Support appliance stores and injects the credentials technicians use to reach company laptops and servers. Mandiant says the group used compromised admin accounts inside Remote Support, changed permissions to control remote systems and used the built-in file transfer feature to pull documents such as software inventories off users’ desktops.
BeyondTrust-hosted customers are already patched. Self-hosted customers have to apply the BT26-05-RS patch themselves unless automatic updates are on, and anyone on a version older than 24.3.1 has to upgrade first. BeyondTrust also released the patch for Privileged Remote Access, which shares the affected code, though its testing found no way to exploit PRA. Mandiant warns that broad, opportunistic exploitation often follows disclosure with this group.
Patch Remote Support today, then go looking
- Apply the BT26-05-RS patch on every self-hosted Remote Support appliance on 24.3.1 through 26.2.3. Upgrade older appliances to a supported version first, then patch.
- Apply the same patch to self-hosted Privileged Remote Access appliances.
- Limit internet access to the appliance to the services customers and staff need, and restrict the admin interface to trusted networks, as CISA recommends.
- If the appliance was reachable from the internet before you patched, follow CISA’s steps: snapshot it, forward syslog and session events to your SIEM, rotate every credential it stored or injected, revoke active sessions and review new MFA registrations on privileged accounts.
Forward this
For whoever owns our BeyondTrust Remote Support (the help desk screen-sharing tool): a China-linked spy group has been exploiting it since August, and CISA wants it fixed by today, October 19. Can we confirm whether we host our own appliance, apply BeyondTrust’s BT26-05 patch today, and have security check it for signs of a break-in before we call it done?
Details
- CVE-2026-102764: improper origin validation in an internal messaging component (CWE-290), CVSS 4.0 score 9.3, no authentication. BeyondTrust advisory BT26-05, October 15, 2026.
- Affected: Remote Support, all versions up to and including 26.2.3. Fix: BT26-05-RS patch for 24.3.1 through 26.2.3; older versions must upgrade first. SaaS patched October 9.
- KEV: added October 16, 2026; federal due date October 19, 2026; ransomware use listed as unknown.
- Actor: ARMORY CASTLE (formerly UNC5221; CrowdStrike tracks it as WARP PANDA). Tools: SAWFLY webshell, BARECLAW tunneler.
Hunt / verify
- Remote Support admin or privileged sessions you do not recognize, and account permission or session-policy changes since August 29.
- Unrecognized script files on the appliance and gaps in log forwarding. Mandiant notes the useful evidence sits in access, syslog and SSL logs on the appliance’s encrypted
/homepartition. - Large file transfers from user desktops through the Remote Support file transfer feature.
Source: BeyondTrust advisory BT26-05; CISA alert, October 16, 2026; Mandiant: ARMORY CASTLE Exploits BeyondTrust
Sources
- BeyondTrust: Security advisory BT26-05
- BeyondTrust: ARMORY CASTLE and BT26-05, What Security Teams Need to Know
- Google Cloud / Mandiant: ARMORY CASTLE Exploits BeyondTrust
- CISA: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 16, 2026)
- SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
- CVE.org: CVE-2026-102764
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
