Armory Castle Exploited BeyondTrust Remote Support Zero-Day CVE-2026-102764 to Seize Appliances and Pivot Downstream

A remote support appliance holds the keys to every system it can reach. That is why Armory Castle went after one. The China-nexus espionage group, previously tracked as UNC5221 or Warp Panda, exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support, formerly Bomgar, as a zero-day. The first confirmed exploitation hit a single self-hosted appliance on August 29, 2026. BeyondTrust did not finish patching its SaaS tenants until October 9, 41 days later. It published its alert on October 15.

The flaw is improper origin validation in an internal messaging component. In BeyondTrust's words, the components "did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance." For a remote attacker, a file write on a support appliance is a short step from code execution, and that is what happened next.

Who Armory Castle Is

This group has a track record of breaking edge devices. It has been active since at least October 2023 and has used zero-days in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282). Its targets include legal services, SaaS providers, business-process outsourcers, technology firms and governments. The goal is long-term intelligence collection, not disruption.

BeyondTrust described the group's pattern: "The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched." The vendor added that its working assessment is that the actor picks high-value software targets in advance and keeps a model of each target product in an AI context, which it uses over time to build exploit chains.

How the Zero-Day Was Found

BeyondTrust's timeline shows the discovery was indirect. On September 27, 2026, a successful exploitation of another security device provider became public. That prompted BeyondTrust to hunt its own install base for similar activity, which surfaced the August 29 intrusion. So the appliance was compromised for about a month before the vendor knew, and the patch rollout took almost two more weeks.

The Intrusion Chain

Google Threat Intelligence Group and Mandiant documented what came after initial access. The operator connected through commercial VPN exit nodes and compromised home and small-office routers so the traffic looked normal. Once in, they deployed SAWFLY, a lightweight PHP web shell that gives interactive remote access and encrypted two-way command and control. From that foothold, the observed actions were:

• Root via SUID shell: copied /bin/sh to /usr/bin/dbus-authd, set the owner to root and enabled the SUID bit, giving a root shell under a name that looks like a legitimate system service.
• Secrets harvesting: used the proprietary /ns/sbin/bt-secrets CLI to try to pull passwords, API keys and endpoint credentials from the appliance's native secrets database.
• Configuration template abuse: targeted BeyondTrust configuration templates to give the site service account passwordless root.
• Application pivot: logged into Remote Support with compromised administrator credentials, ran reconnaissance, and opened sessions to downstream systems listed in the Jump Item list.
• Internal file theft: used those sessions to get full file-system access on internal endpoints and exfiltrate sensitive internal documents for network reconnaissance.
• Tunneling: deployed BARECLAW, a custom SOCKS5 proxy tunneler written in C that relays TCP connections between a remote client and internal destinations.
• Exposure: edited /ns/config/haproxy.conf so BARECLAW could be reached straight from the internet.
• Anti-forensics: systematically deleted system, web server and application logs.

The researchers noted that the operator showed "a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates and local reverse-proxy routing." This was not generic Linux post-exploitation. The group knew where the product stores credentials and how its proxy routes traffic.

Why the Blast Radius Is Large

Remote support platforms are built to reach everything: servers, workstations, network gear, and often third-party client environments. The Jump Item list is a ready-made map of high-value targets, and the stored credentials are the keys to them. An attacker with root on the appliance and admin rights in the application does not need to move laterally the usual way. They can use the product as designed, through sessions that look like normal support work to most monitoring tools.

For managed service providers and business-process outsourcers, this goes past one company. One compromised appliance can reach every customer environment it supports, and those are sectors Armory Castle has already gone after.

Vendor Fix and Guidance

BeyondTrust pushed the fix to all Remote Support SaaS customers by October 9, 2026. Self-hosted customers on versions 24.3.1 through 26.2.3 must apply the BT26-05-RS patch manually. Instances older than 24.3.1 must first upgrade to a supported version before the fix can be applied.

Published indicators include the file /usr/bin/dbus-authd, unexpected changes to /ns/config/haproxy.conf, use of the bt-secrets utility outside normal administration, and gaps in appliance logs. Any credential stored on an exposed appliance during the window should be treated as known to the attacker, and that includes credentials for downstream Jump Item systems.

RedEye Assessment

This is the fourth vendor family Armory Castle has hit with zero-days, after Citrix and Ivanti, and the targeting logic is the same each time: compromise the device that already has trusted access to everything else. The group's reported use of a persistent AI model of target products points to faster exploit development and shorter gaps between campaigns. Organizations that ran an exposed Remote Support instance between late August and their patch date face a compromise review, not just a patch ticket. RedEye Security can assess exposure, review appliance integrity and scope downstream credential risk for affected environments.