Vulnerability ManagementIncident ResponseSOC
BeyondTrust has patched an authentication bypass in its Remote Support product, CVE-2026-102764, that attackers had been exploiting as a zero-day since late August. According to BleepingComputer, the flaw lets an unprivileged remote attacker perform file operations on unpatched appliances. Mandiant spotted the initial attacks and attributes them to a suspected China-nexus espionage actor it tracks as Armory Castle, formerly UNC5221. CrowdStrike tracks the same group as Warp Panda.
BeyondTrust published its customer advisory on 16 October. SaaS customers were patched on 8 October. Self-hosted customers have to patch manually unless automatic updates are on.
Shadowserver tracks more than 1,400 BeyondTrust remote support instances exposed online. It does not say how many are already patched or how many are honeypots.
Mandiant and Google Threat Intelligence Group described the chain they observed:
Steps 4 and 5 are the ones that change the response. A remote support appliance exists to open sessions into other machines, so a remote session launched from it looks like normal use. And if the attacker cleared the appliance's own logs, the box itself cannot tell you what happened.
We covered the Citrix NetScaler zero-days last week, where the lesson was that patching does not remove a web shell already on the device. That applies here too. But a remote support tool adds a second problem: it holds or brokers credentials for the systems it connects to, and its whole purpose is reaching those systems.
That is why Mandiant's advice goes past the appliance. Treat any internet-reachable instance that ran a vulnerable version during the exploitation window as potentially compromised until reviewed, and include any credentials the appliance stored or brokered in that review. Mandiant also warns that wider opportunistic exploitation may follow, as it has after earlier Armory Castle campaigns.
The group's history supports that. It has previously exploited Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282), and Volexity reported in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances. BeyondTrust products have been targeted before as well, including CVE-2024-12356 and CVE-2024-12686, which Silk Typhoon reportedly used to compromise 17 Remote Support SaaS instances, one of them used by the U.S. Treasury Department.
Wiping logs only works if the logs live only on the machine being wiped. Obiguard SOC streams logs and host metrics off each system through OpenTelemetry as they are written, so a copy sits outside the appliance before an intruder gets root. Live Logs makes those events searchable by source and level, alerts fire on rule matches and log volume, and each alert keeps an evidence timeline linked to the raw events that triggered it. For a breach like this one, that is the difference between reconstructing which downstream sessions were opened and having nothing to look at.
SOC's CVE Radar cross-checks dependency findings in connected repos against CISA KEV and FIRST EPSS. That covers code you build, not a vendor appliance, so it will not flag this CVE on your BeyondTrust box. The useful step is getting the appliance and the systems it connects to forwarding logs before the next one.
If an attacker cleared the logs on your remote support appliance tonight, where else would a record exist of the sessions it opened, and would anyone notice the logs had stopped?
See how Obiguard SOC works or talk to us about getting logs off the systems that attackers most want to clean up.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →