The China-linked cyber espionage group known as Armory Castle has exploited a newly disclosed zero-day vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764, to gain unauthorized access to remote support servers. This exploitation occurred on August 29, 2026, and was confirmed by BeyondTrust in an alert issued on October 9, 2026. The vulnerability, which has a CVSS score of 9.3, involves improper origin validation in an internal messaging component, allowing remote attackers to perform unauthorized file operations on affected appliances.
BeyondTrust reported that patches for the vulnerability were distributed to all Remote Support SaaS customers, while self-hosted customers running specific versions were advised to manually update to the latest patch. The company noted that those using versions older than 24.3.1 must upgrade to a newer version to apply the fix.
Exploitation Timeline and Impact
According to BeyondTrust, Armory Castle’s exploitation of the zero-day vulnerability was first detected on a single self-hosted Remote Support appliance. Following this, on September 27, 2026, the successful exploitation of another security device provider became public, prompting BeyondTrust to investigate similar activities. Armory Castle has a history of targeting vulnerabilities in various systems, including Citrix NetScaler and Ivanti Connect Secure, to conduct long-term intelligence collection across multiple sectors, including technology and government.
BeyondTrust’s assessment indicates that Armory Castle selectively targets high-value software and maintains a working model of the products it exploits, utilizing AI to develop exploit chains. This strategic targeting allows the group to maximize the impact of its operations.
Post-Exploitation Techniques
Following a successful compromise, Armory Castle deployed a lightweight PHP web shell, codenamed SAWFLY, which facilitated interactive remote access and bidirectional encrypted command-and-control (C2) communication. The group utilized commercial VPN exit nodes and compromised home routers to obscure its traffic, enhancing its operational security.
The intrusion was characterized by several sophisticated techniques aimed at credential theft and lateral movement within the network. Key actions included:
- Gaining root-level control of the appliance host by modifying system files to execute with elevated privileges.
- Harvesting credentials from the appliance’s native secrets management database using proprietary command-line utilities.
- Pivoting into the BeyondTrust Remote Support application to conduct reconnaissance and launch remote sessions to downstream systems.
- Establishing remote support sessions to access internal endpoints and exfiltrate sensitive documents.
- Utilizing a custom SOCKS5 proxy to tunnel traffic through the compromised device.
- Deleting logs to hinder detection efforts.
Researchers from Google Threat Intelligence Group and Mandiant emphasized that Armory Castle demonstrated a deep understanding of BeyondTrust appliance internals, which facilitated their exploitation efforts. They advised that any appliance reachable from the internet during the exploitation window should be treated as potentially compromised until thoroughly reviewed.
This incident underscores the critical need for organizations to promptly apply security patches and maintain vigilance against sophisticated cyber threats, particularly those linked to state-sponsored actors like Armory Castle.
For further details on the vulnerability and its implications, refer to the report by The Hacker News.
