A Suspected China-Nexus Group Used a BeyondTrust Remote Support Zero-Day in August, and Patching Will Not Undo a Compromise

BeyondTrust disclosed on Thursday, October 15 that attackers exploited a flaw in its Remote Support appliances before a fix existed. Google Threat Intelligence Group (GTIG) and Mandiant tie the intrusion they investigated to ARMORY CASTLE, a suspected China-nexus espionage group that Google formerly tracked as UNC5221. The flaw, CVE-2026-102764, is scored 9.3 on the CVSS 4.0 scale and lets a remote attacker with no credentials perform file operations on the appliance. BeyondTrust’s own timeline, as The Hacker News relays it, puts exploitation on one self-hosted appliance on Saturday, August 29. BeyondTrust had patched its SaaS customers by October 9, and self-hosted customers have to install the fix themselves.

The advice that matters most for anyone running the product comes from Google’s report: an appliance that was reachable from the internet on a vulnerable version during the exploitation window “should be treated as potentially compromised until it has been reviewed,” and one whose status is confirmed or unknown should be rebuilt from a clean, patched image, because the attacker’s access at the host level survives reboots and configuration resets. Installing the patch closes the hole. It does not remove someone who is already inside.

What the sources say happened

BleepingComputer’s headline says the flaw was “exploited in attacks since August.” The sources we could read document something narrower. BeyondTrust’s timeline lists a single self-hosted appliance on August 29, and Google’s report describes one incident response engagement. Neither gives a total count of victims. Both warn that the next phase may be broader: BeyondTrust says the group “typically moves to broad exploitation of every instance still unpatched” once a flaw is public, and Google points to 2024, when it saw widespread exploitation after the disclosure of CVE-2023-46805 and CVE-2024-21887, two Ivanti Connect Secure flaws.

Counting from those dates, which is our arithmetic, it is 47 days from August 29 to the disclosure and 41 days to the SaaS patch (40 on BleepingComputer’s October 8 date). Using October 9, the patch came 12 days after the September 27 prompt, and public disclosure followed 6 days after the patch. None of the reports we read says when the self-hosted patch was released, so we cannot tell how long self-hosted customers had it before Thursday. The statement as relayed also does not name the other security device provider. The Citrix NetScaler zero-days that we covered on September 27 fit the date, but that match is our inference.

The flaw itself is described in thin and differing terms. The NVD record repeats BeyondTrust’s wording: the components “did not adequately validate the origin of the messages it received,” which “could allow an attacker to perform file operations on the appliance.” It names CWE-290, authentication bypass by spoofing, carries the 9.3 score supplied by the source that published the record, and lists no affected versions yet. Google calls the result “the arbitrary upload of files,” and BleepingComputer calls the flaw an authentication bypass. We found no public exploit code, though the check was narrow: a GitHub repository search for the CVE ID and for BT26-05 returned no results at 10:14 UTC on October 16.

What the attackers did after getting in

Mandiant reconstructed the intrusion from appliance logs and says the actor showed “a deep understanding of BeyondTrust appliance internals.” The steps below are Mandiant’s account of the intrusion it investigated.

Mandiant found its evidence in logs that sit on an encrypted partition holding the /home directory, and its guidance says “Customers cannot audit the appliance host file system.” In practice, the checks below rely on the admin console’s audit trail and on logs kept outside the appliance.

What defenders are told to do

For an appliance that was exposed, Mandiant recommends preserving evidence before changing anything: snapshot virtual appliances with memory, export the disk, and, for B Series hardware and SaaS tenants, ask BeyondTrust Support for forensic preservation. It also says to collect syslog, reverse-proxy or WAF and perimeter firewall logs, because an attacker with host access can delete the logs on the appliance. If the compromise is confirmed or the status is unknown, the report says to redeploy from a clean, fully patched image instead of cleaning in place, and, when restoring, to use a configuration backup dated before the exposure window, or the newest backup only while isolated and after the review is complete.

Credential rotation comes after that, not before. Google’s note reads: “Rotate credentials only after the appliance has been patched or rebuilt. Rotating earlier exposes the new credentials to an attacker who still controls the appliance.” Its list runs from the /appliance administrator credentials through /login administrators, API client secrets, security-provider bind accounts and SAML signing keys, vault and Password Safe credentials, integration credentials, and anything typed into a support session during the window.

Without host access, the report points to signals that the console and perimeter can show: user_changed events that raise a Jump Item or team role, new users, API accounts or security providers with no change ticket, changed outbound-event or syslog destinations, successful logins from residential-broadband or commercial-VPN address space, administrative logins outside business hours, file-transfer events in support-session reports, unknown .php paths or WebSocket upgrades at a reverse proxy, and gaps in syslog forwarding. On that last one it says “an interruption bounded by a single session is a strong indicator of log tampering.” It also advises limiting /login and /appliance to known networks so that only representative console, customer portal and Jump Client traffic reaches the internet.

What the reports leave open

Scale. BleepingComputer cites Shadowserver for more than 1,400 internet-exposed Remote Support instances and notes that Shadowserver does not say how many are patched or are honeypots. We did not check the dashboard. Nothing we read gives a total count of victims.

Product scope. NVD, Google and The Hacker News name Remote Support only. BleepingComputer says BeyondTrust patched its Remote Support and Privileged Remote Access SaaS customers, and the NVD record has no affected-product data yet. Whether Privileged Remote Access appliances are affected is something to confirm in BT26-05 itself, which we could not read (see the method note below).

The AI claim. BeyondTrust’s own working assessment, as The Hacker News quotes it, is that the group “keeps a working model of the products the actor targets in an AI context that it uses on an ongoing basis to develop exploit chains.” Google’s report does not make that claim, and nothing we read shows the evidence behind it, so we treat it as the vendor’s assessment, not an established finding.

CISA. The KEV feed predates the NVD record by more than four hours, so its silence on the CVE says little. For reference, BeyondTrust already has three KEV entries: CVE-2024-12356 (added December 19, 2024), CVE-2024-12686 (January 13, 2025) and CVE-2026-1731 (February 13, 2026), the last flagged for known ransomware use. We counted these from the feed.

A pattern, not a one-off

February offers a precedent. According to The Hacker News, BeyondTrust first detected exploitation of CVE-2026-1731 on January 31, after anomalous activity on a single Remote Support appliance, and disclosed it on February 6. CISA listed it on February 13, and within a week of that listing Palo Alto Networks’ Unit 42 was reporting web shells, backdoors and data theft across several sectors. In July, another update fixed two critical pre-authentication flaws, both scored 9.2, and the report on it said BeyondTrust made no mention of exploitation. That makes October’s fix the third Remote Support update this year, among those we found, to carry a score of 9 or higher.

The group’s history points the same way. Google says ARMORY CASTLE has been active since at least October 2023 and has exploited multiple edge-appliance flaws, and BleepingComputer lists Citrix NetScaler and Ivanti Connect Secure among its past targets and says CrowdStrike tracks the group as Warp Panda. Defenders who run other remote-access gateways have had a busy month; we covered the Ivanti Connect Secure zero-day chain on October 13 and a SonicWall SMA1000 flaw probed two days after its patch on October 12. Those stories involve different flaws, and we have not seen a link between them and this one.

Sources and method

We read Google’s report in full, The Hacker News and BleepingComputer, the NVD record (through its REST API), and CISA’s KEV feed, which we checked at 10:13 UTC on October 16. We also used The Hacker News’s reports from February and July for the earlier advisories. BeyondTrust’s own advisory and blog post returned a bot check to automated requests and the knowledge-base article behind the NVD record needs a customer login, so BeyondTrust’s statements here come from Google and The Hacker News, and the SaaS patch date is October 9 in two of them and October 8 in the third. Weekdays and day counts are our own arithmetic from the dates given. We did not test anything on an appliance, and we left out Google’s indicator hashes and detection rules, which are in its report.