A Chinese state‑sponsored APT, Armory Castle (UNC5221/Warp Panda), has been exploiting a BeyondTrust Remote Support vulnerability as a zero‑day since August 2026. The flaw, CVE-2026-102764, allows improper validation of message origins and could enable a remote attacker to carry out file operations on RS appliances. BeyondTrust states that all RS versions up to and including 26.2.3 are affected.
The mitigation is a patch released as BT26-05 for RS versions 24.3.1 to 26.2.3; users on older releases should upgrade to a newer version before applying the patch. Exploitation reportedly began on 29 August, with initial access gained on one BeyondTrust‑hosted and one self‑hosted RS appliance; BeyondTrust disclosed the defect on 28 September, a day after public exposure of the compromise at a security device provider.
Mandiant and Google Threat Intelligence Group (GTIG) describe the actors’ subsequent actions: deploying the Sawfly PHP webshell and Bareclaw tunneller to gain elevated privileges and move laterally, harvesting credentials, and deleting system, web server and application logs.
The threat actor then pivoted to the RS application using compromised administrator credentials, altering permissions to control internal endpoints, and using the appliance’s built‑in file transfer service to exfiltrate sensitive documents from the user’s desktop environment. Bareclaw supplied encrypted C2 and proxy capabilities for traffic chaining.
GTIG notes Armory Castle has previously leveraged multiple edge‑appliance zero‑days and a broad toolkit; its activity spans technical targets across several sectors since at least October 2023. As of 9 October 2026, BeyondTrust reports the patch is deployed to all RS SaaS customers, with self‑hosted customers instructed to apply manually where automatic updates are unavailable.