BeyondTrust flaw was secretly exploited since late August, and patching is no longer enough

Requests sent with no password at all to a PHP file. Eleven minutes later, a "web shell," a backdoor hidden in a web page, appears on the server. According to Mandiant, this is how attackers gained a foothold in BeyondTrust Remote Support appliances, the remote assistance tool many IT departments use to take control of workstations.

On October 15, BeyondTrust disclosed the vulnerability CVE-2026-102764. The same day, the Google Threat Intelligence Group (which includes Mandiant) published its investigation: the flaw was exploited as a "zero-day," meaning before any patch existed, since late August 2026. It affects all supported versions of Remote Support up to 26.2.3. The fix, named BT26-05, was applied to SaaS (hosted service) customers in early October: on the 8th according to BleepingComputer, on the 9th according to Mandiant. Customer-hosted installations must be patched manually if automatic updates are disabled.

Who is behind it, and what did they take?

Mandiant attributes these attacks to Armory Castle, an espionage group it suspects of ties to China and previously tracked as UNC5221. This group has already exploited zero-day flaws in Citrix NetScaler and Ivanti Connect Secure. No victim or sector has been named.

In the case Mandiant studied, the attackers obtained "root" rights (top-level administrator) on the appliance. They emptied the vault where the device stores credentials, installed a persistence mechanism that survives reboots, then wiped the logs. They then logged into the administration console with a compromised administrator account and expanded that account's rights over the managed machines. They opened support sessions to copy documents and installed a stealthy tunnel, which Mandiant calls BARECLAW.

That is the problem: such an appliance holds the keys to a large part of the IT estate. According to Mandiant, the flaw can lead to control of the host and to "every credential the appliance stores or relays." The Shadowserver Foundation counts more than 1,400 BeyondTrust remote support instances exposed on the Internet, without specifying how many are patched.

What to do if you use Remote Support

Because the flaw was exploited for more than a month before it became known, applying the patch is not enough. Mandiant recommends the following measures:

• Patch first: apply BT26-05 (BT26-05-RS for customer-hosted installations). Below version 24.3.1, you must first upgrade to a supported version. Mandiant warns that the update closes the flaw but does not repair an earlier compromise.
• Treat as potentially compromised any appliance reachable from the Internet that remained vulnerable during the exploitation period, until verified.
• Preserve evidence (virtual machine snapshots, firewall and proxy logs) before making any changes, since the attacker wipes logs on the appliance.
• Rebuild rather than clean up a compromised appliance, from a clean image, with a new TLS certificate.
• Change credentials only after patching or rebuilding: according to Mandiant, changing them beforehand would expose the new ones to an attacker who is still present.
• Check permissions in the administration console, especially roles that suddenly changed to "Administrator."

Mandiant also publishes indicators of compromise: a file /usr/bin/dbus-authd owned by root with the SUID bit (which gives the owner's rights to anyone who runs it), a script zz-root-persist, the path /uidchanarge in the HAProxy configuration (the appliance's load balancer), and TCP port 19800.

A second wave to expect?

Remote access tools remain a prime target: just this week, a flaw in Ivanti Connect Secure was exploited before a patch was available. Mandiant considers it possible that mass exploitation attempts will follow, because Armory Castle tends to opportunistically reuse flaws once they are public. The coming days will show whether other groups seize on it.